GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56715 (GCVE-0-2024-56715)

Vulnerability from cvelistv5 – Published: 2024-12-29 08:48 – Updated: 2026-08-05 11:46
VLAI
Title
ionic: Fix netdev notifier unregister on failure
Summary
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:58 UTC
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 30b87ab4c0b30e0f681cb7dfaab6c642dd17e454 , < 87847938f5708b2509b279369c96572254bcf2ba (git)
Affected: 30b87ab4c0b30e0f681cb7dfaab6c642dd17e454 , < da93a12876f8b969df7316dc93aac7e725f88252 (git)
Affected: 30b87ab4c0b30e0f681cb7dfaab6c642dd17e454 , < da5736f516a664a9e1ff74902663c64c423045d2 (git)
Affected: 30b87ab4c0b30e0f681cb7dfaab6c642dd17e454 , < ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6 (git)
Affected: 30b87ab4c0b30e0f681cb7dfaab6c642dd17e454 , < 9590d32e090ea2751e131ae5273859ca22f5ac14 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.176 , ≤ 5.15.* (semver)
Unaffected: 6.1.122 , ≤ 6.1.* (semver)
Unaffected: 6.6.68 , ≤ 6.6.* (semver)
Unaffected: 6.12.7 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:58:37.829177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:06.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:53:03.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87847938f5708b2509b279369c96572254bcf2ba",
              "status": "affected",
              "version": "30b87ab4c0b30e0f681cb7dfaab6c642dd17e454",
              "versionType": "git"
            },
            {
              "lessThan": "da93a12876f8b969df7316dc93aac7e725f88252",
              "status": "affected",
              "version": "30b87ab4c0b30e0f681cb7dfaab6c642dd17e454",
              "versionType": "git"
            },
            {
              "lessThan": "da5736f516a664a9e1ff74902663c64c423045d2",
              "status": "affected",
              "version": "30b87ab4c0b30e0f681cb7dfaab6c642dd17e454",
              "versionType": "git"
            },
            {
              "lessThan": "ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6",
              "status": "affected",
              "version": "30b87ab4c0b30e0f681cb7dfaab6c642dd17e454",
              "versionType": "git"
            },
            {
              "lessThan": "9590d32e090ea2751e131ae5273859ca22f5ac14",
              "status": "affected",
              "version": "30b87ab4c0b30e0f681cb7dfaab6c642dd17e454",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.122",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.68",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: Fix netdev notifier unregister on failure\n\nIf register_netdev() fails, then the driver leaks the netdev notifier.\nFix this by calling ionic_lif_unregister() on register_netdev()\nfailure. This will also call ionic_lif_unregister_phc() if it has\nalready been registered."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both the creation of the dangling notifier (a local PCI driver probe of a Pensando/AMD ionic NIC) and the dereference (a local netdev event such as network-namespace creation) occur entirely on the local system; no network packet or remote peer data reaches this path.\nAC:L - Once probe has failed and left `ionic-\u003enb` on `netdev_chain`, the freed-memory dereference is deterministic and infinitely repeatable \u2014 every `unshare -Urn`, container start, or `ip link` event walks the chain, with no race to win and no unpredictable memory layout required.\nPR:L - Reaching the dangling notifier requires no privilege beyond an ordinary local user: creating a network namespace via an unprivileged user namespace registers `lo` and fires `call_netdevice_notifiers(NETDEV_REGISTER)`, and the same user can groom the freed `struct ionic` region (kernel-stack/vmalloc and slab reclaim) to control the values read back.\nUI:N - No action by any victim user or administrator is needed at exploitation time; the attacker triggers the notifier chain walk himself through ordinary namespace or interface operations.\nS:U - The use-after-free corrupts kernel memory and hijacks control flow within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `notifier_call_chain()` reads `nb-\u003enext` and `nb-\u003enotifier_call` from the freed `struct ionic`, and the surviving `ionic_lif_notify()` callback further dereferences the stale `ionic`/`lif` pointers, so a reclaimed and attacker-shaped allocation yields an arbitrary kernel-read primitive.\nI:H - The chain walk performs `nb-\u003enotifier_call(nb, val, v)` on a function pointer loaded from freed memory \u2014 a direct indirect-call/control-flow-hijack primitive \u2014 and the corrupted `nb-\u003enext` linkage additionally lets a later `raw_notifier_chain_unregister()` write through attacker-influenced pointers.\nA:H - After a failed ionic probe the machine is left one netdev event away from an oops or panic in `notifier_call_chain()`, and any unprivileged user can force that crash on demand and repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:13.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/da93a12876f8b969df7316dc93aac7e725f88252"
        },
        {
          "url": "https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14"
        }
      ],
      "title": "ionic: Fix netdev notifier unregister on failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56715",
    "datePublished": "2024-12-29T08:48:48.433Z",
    "dateReserved": "2024-12-27T15:00:39.857Z",
    "dateUpdated": "2026-08-05T11:46:13.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56715",
      "date": "2026-09-16",
      "epss": "0.00262",
      "percentile": "0.18209"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10\", \"versionEndExcluding\": \"5.15.176\", \"matchCriteriaId\": \"5CA30DA6-FB1E-4C3C-832B-31CC8322D57D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.122\", \"matchCriteriaId\": \"3B06AD1C-E7B3-4B24-A884-D3BE92CC042F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.68\", \"matchCriteriaId\": \"74BA9823-CCED-4B24-815D-B82543954BF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.7\", \"matchCriteriaId\": \"811AC89A-14AC-49FA-9B54-E99526F1CA47\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nionic: Fix netdev notifier unregister on failure\\n\\nIf register_netdev() fails, then the driver leaks the netdev notifier.\\nFix this by calling ionic_lif_unregister() on register_netdev()\\nfailure. This will also call ionic_lif_unregister_phc() if it has\\nalready been registered.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ionic: Arreglar la cancelaci\\u00f3n del registro del notificador netdev en caso de error Si register_netdev() falla, el controlador filtra el notificador netdev. Solucione esto llamando a ionic_lif_unregister() en caso de error de register_netdev(). Esto tambi\\u00e9n llamar\\u00e1 a ionic_lif_unregister_phc() si ya se ha registrado.\"}]",
      "id": "CVE-2024-56715",
      "lastModified": "2025-01-10T18:31:19.583",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-29T09:15:06.643",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/da93a12876f8b969df7316dc93aac7e725f88252\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-13T00:00:00.000Z",
      "cve": "CVE-2024-56715",
      "id": "msrc_CVE-2024-56715",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ionic: Fix netdev notifier unregister on failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56715.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56715\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-29T09:15:06.643\",\"lastModified\":\"2026-08-04T11:22:23.413\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nionic: Fix netdev notifier unregister on failure\\n\\nIf register_netdev() fails, then the driver leaks the netdev notifier.\\nFix this by calling ionic_lif_unregister() on register_netdev()\\nfailure. This will also call ionic_lif_unregister_phc() if it has\\nalready been registered.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ionic: Arreglar la cancelaci\u00f3n del registro del notificador netdev en caso de error Si register_netdev() falla, el controlador filtra el notificador netdev. Solucione esto llamando a ionic_lif_unregister() en caso de error de register_netdev(). Esto tambi\u00e9n llamar\u00e1 a ionic_lif_unregister_phc() si ya se ha registrado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/pensando/ionic/ionic_lif.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\",\"lessThan\":\"87847938f5708b2509b279369c96572254bcf2ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\",\"lessThan\":\"da93a12876f8b969df7316dc93aac7e725f88252\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\",\"lessThan\":\"da5736f516a664a9e1ff74902663c64c423045d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\",\"lessThan\":\"ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\",\"lessThan\":\"9590d32e090ea2751e131ae5273859ca22f5ac14\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/pensando/ionic/ionic_lif.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.176\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.122\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.68\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.7\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:58:37.829177Z\",\"id\":\"CVE-2024-56715\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.15.176\",\"matchCriteriaId\":\"5CA30DA6-FB1E-4C3C-832B-31CC8322D57D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.122\",\"matchCriteriaId\":\"3B06AD1C-E7B3-4B24-A884-D3BE92CC042F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.68\",\"matchCriteriaId\":\"74BA9823-CCED-4B24-815D-B82543954BF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.7\",\"matchCriteriaId\":\"811AC89A-14AC-49FA-9B54-E99526F1CA47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da93a12876f8b969df7316dc93aac7e725f88252\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:13+00:00",
      "cve": "CVE-2024-56715",
      "id": "CVE-2024-56715",
      "initial_release_date": "2024-12-29T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ionic: Fix netdev notifier unregister on failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56715.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:20:40Z",
      "cve": "CVE-2024-56715",
      "id": "CVE-2024-56715",
      "initial_release_date": "2024-12-30T03:48:35Z",
      "product_status:known_affected": "590",
      "product_status:known_not_affected": "319",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56715",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56715.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:53:03.632Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56715\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:58:37.829177Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-401\", \"description\": \"CWE-401 Missing Release of Memory after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:47:41.934Z\"}}], \"cna\": {\"title\": \"ionic: Fix netdev notifier unregister on failure\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Both the creation of the dangling notifier (a local PCI driver probe of a Pensando/AMD ionic NIC) and the dereference (a local netdev event such as network-namespace creation) occur entirely on the local system; no network packet or remote peer data reaches this path.\\nAC:L - Once probe has failed and left `ionic-\u003enb` on `netdev_chain`, the freed-memory dereference is deterministic and infinitely repeatable \\u2014 every `unshare -Urn`, container start, or `ip link` event walks the chain, with no race to win and no unpredictable memory layout required.\\nPR:L - Reaching the dangling notifier requires no privilege beyond an ordinary local user: creating a network namespace via an unprivileged user namespace registers `lo` and fires `call_netdevice_notifiers(NETDEV_REGISTER)`, and the same user can groom the freed `struct ionic` region (kernel-stack/vmalloc and slab reclaim) to control the values read back.\\nUI:N - No action by any victim user or administrator is needed at exploitation time; the attacker triggers the notifier chain walk himself through ordinary namespace or interface operations.\\nS:U - The use-after-free corrupts kernel memory and hijacks control flow within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `notifier_call_chain()` reads `nb-\u003enext` and `nb-\u003enotifier_call` from the freed `struct ionic`, and the surviving `ionic_lif_notify()` callback further dereferences the stale `ionic`/`lif` pointers, so a reclaimed and attacker-shaped allocation yields an arbitrary kernel-read primitive.\\nI:H - The chain walk performs `nb-\u003enotifier_call(nb, val, v)` on a function pointer loaded from freed memory \\u2014 a direct indirect-call/control-flow-hijack primitive \\u2014 and the corrupted `nb-\u003enext` linkage additionally lets a later `raw_notifier_chain_unregister()` write through attacker-influenced pointers.\\nA:H - After a failed ionic probe the machine is left one netdev event away from an oops or panic in `notifier_call_chain()`, and any unprivileged user can force that crash on demand and repeatedly.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\", \"lessThan\": \"87847938f5708b2509b279369c96572254bcf2ba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\", \"lessThan\": \"da93a12876f8b969df7316dc93aac7e725f88252\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\", \"lessThan\": \"da5736f516a664a9e1ff74902663c64c423045d2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\", \"lessThan\": \"ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"30b87ab4c0b30e0f681cb7dfaab6c642dd17e454\", \"lessThan\": \"9590d32e090ea2751e131ae5273859ca22f5ac14\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/pensando/ionic/ionic_lif.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.176\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/pensando/ionic/ionic_lif.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba\"}, {\"url\": \"https://git.kernel.org/stable/c/da93a12876f8b969df7316dc93aac7e725f88252\"}, {\"url\": \"https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2\"}, {\"url\": \"https://git.kernel.org/stable/c/ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6\"}, {\"url\": \"https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nionic: Fix netdev notifier unregister on failure\\n\\nIf register_netdev() fails, then the driver leaks the netdev notifier.\\nFix this by calling ionic_lif_unregister() on register_netdev()\\nfailure. This will also call ionic_lif_unregister_phc() if it has\\nalready been registered.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.176\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.122\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.68\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.7\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:13.550Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56715\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:13.550Z\", \"dateReserved\": \"2024-12-27T15:00:39.857Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-29T08:48:48.433Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.