GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56720 (GCVE-0-2024-56720)

Vulnerability from cvelistv5 – Published: 2024-12-29 11:29 – Updated: 2026-08-05 11:46
VLAI
Title
bpf, sockmap: Several fixes to bpf_msg_pop_data
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpf_msg_pop_data Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, we should put_page 2. if (len == 0), return early is better 3. pop the entire sk_msg (last == msg->sg.size) should be supported 4. Fix for the value of variable "a" 5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:58 UTC
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < d3f5763b3062514a234114e97bbde74d8d702449 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < d26d977633d1d0b8bf9407278189bd0a8d973323 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < e1f54c61c4c9a5244eb8159dce60d248f7d97b32 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < f58d3aa457e77a3d9b3df2ab081dcf9950f6029f (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 98c7ea7d11f2588e8197db042e0291e4ac8f8346 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 785180bed9879680d8e5c5e1b54c8ae8d948f4c8 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 275a9f3ef8fabb0cb282a62b9e164dedba7284c5 (git)
Affected: 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 , < 5d609ba262475db450ba69b8e8a557bd768ac07a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:58:21.307610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:06.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:53:12.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3f5763b3062514a234114e97bbde74d8d702449",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "d26d977633d1d0b8bf9407278189bd0a8d973323",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "e1f54c61c4c9a5244eb8159dce60d248f7d97b32",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "f58d3aa457e77a3d9b3df2ab081dcf9950f6029f",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "98c7ea7d11f2588e8197db042e0291e4ac8f8346",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "785180bed9879680d8e5c5e1b54c8ae8d948f4c8",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "275a9f3ef8fabb0cb282a62b9e164dedba7284c5",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            },
            {
              "lessThan": "5d609ba262475db450ba69b8e8a557bd768ac07a",
              "status": "affected",
              "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Several fixes to bpf_msg_pop_data\n\nSeveral fixes to bpf_msg_pop_data,\n1. In sk_msg_shift_left, we should put_page\n2. if (len == 0), return early is better\n3. pop the entire sk_msg (last == msg-\u003esg.size) should be supported\n4. Fix for the value of variable \"a\"\n5. In sk_msg_shift_left, after shifting, i has already pointed to the next\nelement. Addtional sk_msg_iter_var_next may result in BUG."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable helper runs from `sk_psock_msg_verdict()` on the local egress path, requiring a locally loaded BPF_PROG_TYPE_SK_MSG program attached to a sockmap plus a local `sendmsg()` on a sockmap\u0027d socket; there is no remote packet path into `bpf_msg_pop_data()` since SK_MSG programs only process data the local host is sending.\nAC:L - The bug is fully deterministic and entirely attacker-controlled \u2014 the sender chooses the write size that splits the message across scatterlist elements (making `offset != 0`), and the BPF program chooses a `start` that lands in a later element, so `a = start` is guaranteed to exceed `sge-\u003elength` with no race, timing, or memory-layout dependency.\nPR:L - Setting up the sockmap and SK_MSG program requires CAP_BPF and CAP_NET_ADMIN, but `bpf_token_capable()` grants these at `ns_capable()` level inside a user namespace via delegated BPF tokens, and both capabilities are routinely handed to container workloads, so an ordinary unprivileged-in-init-ns user can reach this path.\nUI:N - No victim action is required \u2014 the attacker loads the SK_MSG program and issues the triggering `sendmsg()` entirely on their own, with no file to open, filesystem to mount, or third party to interact with.\nS:U - The out-of-bounds reads, heap overflow, and scatterlist-ring corruption are all confined to the kernel\u0027s own memory and the socket\u0027s psock state; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted scatterlist entry carries an inflated `length` (up to ~4 GB after the signed-to-unsigned wrap of `b`) and an `offset` past the page, and `tcp_bpf_push()` hands those verbatim to `tcp_sendmsg_locked()` with MSG_SPLICE_PAGES, transmitting arbitrary adjacent kernel heap memory to the socket peer; the `!space` path additionally performs `memcpy(to, from, a)` reading far past the source element.\nI:H - In the no-space branch `memcpy(to, from, a)` and `memcpy(to + a, from + a + pop, b)` write attacker-sized data past an undersized `alloc_pages()` allocation \u2014 a controlled heap buffer overflow \u2014 and the missing `put_page()` plus the stray `sk_msg_iter_var_next()` rotate the entire sg ring, installing stale `struct page *` values that produce refcount imbalance and use-after-free of pages.\nA:H - A negative `b` passed to `memcpy()` as `size_t`, a scatterlist entry pointing far outside its page, and `sk_msg_shift_left()` corrupting the whole fragment ring all lead directly to kernel oops/panic, while the missing `put_page()` permanently leaks a page per popped element."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:18.145Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3f5763b3062514a234114e97bbde74d8d702449"
        },
        {
          "url": "https://git.kernel.org/stable/c/d26d977633d1d0b8bf9407278189bd0a8d973323"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1f54c61c4c9a5244eb8159dce60d248f7d97b32"
        },
        {
          "url": "https://git.kernel.org/stable/c/f58d3aa457e77a3d9b3df2ab081dcf9950f6029f"
        },
        {
          "url": "https://git.kernel.org/stable/c/98c7ea7d11f2588e8197db042e0291e4ac8f8346"
        },
        {
          "url": "https://git.kernel.org/stable/c/785180bed9879680d8e5c5e1b54c8ae8d948f4c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/275a9f3ef8fabb0cb282a62b9e164dedba7284c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d609ba262475db450ba69b8e8a557bd768ac07a"
        }
      ],
      "title": "bpf, sockmap: Several fixes to bpf_msg_pop_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56720",
    "datePublished": "2024-12-29T11:29:58.345Z",
    "dateReserved": "2024-12-27T15:00:39.858Z",
    "dateUpdated": "2026-08-05T11:46:18.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56720",
      "date": "2026-09-19",
      "epss": "0.00243",
      "percentile": "0.15824"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "03386EEC-BB89-4FD6-A10A-3326F073C415",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Several fixes to bpf_msg_pop_data\n\nSeveral fixes to bpf_msg_pop_data,\n1. In sk_msg_shift_left, we should put_page\n2. if (len == 0), return early is better\n3. pop the entire sk_msg (last == msg-\u003esg.size) should be supported\n4. Fix for the value of variable \"a\"\n5. In sk_msg_shift_left, after shifting, i has already pointed to the next\nelement. Addtional sk_msg_iter_var_next may result in BUG."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Varias correcciones para bpf_msg_pop_data Varias correcciones para bpf_msg_pop_data, 1. En sk_msg_shift_left, deber\u00edamos put_page 2. si (len == 0), es mejor regresar antes 3. Deber\u00eda ser compatible con la extracci\u00f3n de todo el sk_msg (last == msg-\u0026gt;sg.size) 4. Correcci\u00f3n para el valor de la variable \"a\" 5. En sk_msg_shift_left, despu\u00e9s de cambiar, i ya ha apuntado al siguiente elemento. La adici\u00f3n de sk_msg_iter_var_next puede provocar un ERROR."
        }
      ],
      "id": "CVE-2024-56720",
      "lastModified": "2025-01-09T20:06:46.267",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-12-29T12:15:06.037",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/275a9f3ef8fabb0cb282a62b9e164dedba7284c5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5d609ba262475db450ba69b8e8a557bd768ac07a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/785180bed9879680d8e5c5e1b54c8ae8d948f4c8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/98c7ea7d11f2588e8197db042e0291e4ac8f8346"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d26d977633d1d0b8bf9407278189bd0a8d973323"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d3f5763b3062514a234114e97bbde74d8d702449"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/e1f54c61c4c9a5244eb8159dce60d248f7d97b32"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f58d3aa457e77a3d9b3df2ab081dcf9950f6029f"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-193"
            },
            {
              "lang": "en",
              "value": "CWE-401"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-08T00:00:00.000Z",
      "cve": "CVE-2024-56720",
      "id": "msrc_CVE-2024-56720",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf, sockmap: Several fixes to bpf_msg_pop_data",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56720.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d3f5763b3062514a234114e97bbde74d8d702449",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d26d977633d1d0b8bf9407278189bd0a8d973323",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e1f54c61c4c9a5244eb8159dce60d248f7d97b32",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f58d3aa457e77a3d9b3df2ab081dcf9950f6029f",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98c7ea7d11f2588e8197db042e0291e4ac8f8346",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "785180bed9879680d8e5c5e1b54c8ae8d948f4c8",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "275a9f3ef8fabb0cb282a62b9e164dedba7284c5",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5d609ba262475db450ba69b8e8a557bd768ac07a",
                    "status": "affected",
                    "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.287",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.231",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.174",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.120",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03386EEC-BB89-4FD6-A10A-3326F073C415",
                    "versionEndExcluding": "5.4.287",
                    "versionStartIncluding": "5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935",
                    "versionEndExcluding": "5.10.231",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89",
                    "versionEndExcluding": "5.15.174",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265",
                    "versionEndExcluding": "6.1.120",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7",
                    "versionEndExcluding": "6.6.64",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893",
                    "versionEndExcluding": "6.11.11",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
                    "versionEndExcluding": "6.12.2",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Several fixes to bpf_msg_pop_data\n\nSeveral fixes to bpf_msg_pop_data,\n1. In sk_msg_shift_left, we should put_page\n2. if (len == 0), return early is better\n3. pop the entire sk_msg (last == msg-\u003esg.size) should be supported\n4. Fix for the value of variable \"a\"\n5. In sk_msg_shift_left, after shifting, i has already pointed to the next\nelement. Addtional sk_msg_iter_var_next may result in BUG."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Varias correcciones para bpf_msg_pop_data Varias correcciones para bpf_msg_pop_data, 1. En sk_msg_shift_left, deber\u00edamos put_page 2. si (len == 0), es mejor regresar antes 3. Deber\u00eda ser compatible con la extracci\u00f3n de todo el sk_msg (last == msg-\u0026gt;sg.size) 4. Correcci\u00f3n para el valor de la variable \"a\" 5. En sk_msg_shift_left, despu\u00e9s de cambiar, i ya ha apuntado al siguiente elemento. La adici\u00f3n de sk_msg_iter_var_next puede provocar un ERROR."
          }
        ],
        "id": "CVE-2024-56720",
        "lastModified": "2026-08-04T11:22:25.153",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-56720",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:58:21.307610Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-12-29T12:15:06.037",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/275a9f3ef8fabb0cb282a62b9e164dedba7284c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5d609ba262475db450ba69b8e8a557bd768ac07a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/785180bed9879680d8e5c5e1b54c8ae8d948f4c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/98c7ea7d11f2588e8197db042e0291e4ac8f8346"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d26d977633d1d0b8bf9407278189bd0a8d973323"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3f5763b3062514a234114e97bbde74d8d702449"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e1f54c61c4c9a5244eb8159dce60d248f7d97b32"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f58d3aa457e77a3d9b3df2ab081dcf9950f6029f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-193"
              },
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:39:56+00:00",
      "cve": "CVE-2024-56720",
      "id": "CVE-2024-56720",
      "initial_release_date": "2024-12-29T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, sockmap: Several fixes to bpf_msg_pop_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56720.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:13:57Z",
      "cve": "CVE-2024-56720",
      "id": "CVE-2024-56720",
      "initial_release_date": "2024-12-30T03:48:30Z",
      "product_status:known_affected": "674",
      "product_status:known_not_affected": "235",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56720",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56720.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:53:12.383Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-56720",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:58:21.307610Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-401",
                    "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:48:09.081Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/core/filter.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "d3f5763b3062514a234114e97bbde74d8d702449",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "d26d977633d1d0b8bf9407278189bd0a8d973323",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "e1f54c61c4c9a5244eb8159dce60d248f7d97b32",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "f58d3aa457e77a3d9b3df2ab081dcf9950f6029f",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "98c7ea7d11f2588e8197db042e0291e4ac8f8346",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "785180bed9879680d8e5c5e1b54c8ae8d948f4c8",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "275a9f3ef8fabb0cb282a62b9e164dedba7284c5",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                },
                {
                  "lessThan": "5d609ba262475db450ba69b8e8a557bd768ac07a",
                  "status": "affected",
                  "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/core/filter.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.0"
                },
                {
                  "lessThan": "5.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.287",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.231",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.174",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.120",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.64",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.287",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.231",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.174",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.120",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.64",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.11",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.2",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Several fixes to bpf_msg_pop_data\n\nSeveral fixes to bpf_msg_pop_data,\n1. In sk_msg_shift_left, we should put_page\n2. if (len == 0), return early is better\n3. pop the entire sk_msg (last == msg-\u003esg.size) should be supported\n4. Fix for the value of variable \"a\"\n5. In sk_msg_shift_left, after shifting, i has already pointed to the next\nelement. Addtional sk_msg_iter_var_next may result in BUG."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable helper runs from `sk_psock_msg_verdict()` on the local egress path, requiring a locally loaded BPF_PROG_TYPE_SK_MSG program attached to a sockmap plus a local `sendmsg()` on a sockmap\u0027d socket; there is no remote packet path into `bpf_msg_pop_data()` since SK_MSG programs only process data the local host is sending.\nAC:L - The bug is fully deterministic and entirely attacker-controlled \u2014 the sender chooses the write size that splits the message across scatterlist elements (making `offset != 0`), and the BPF program chooses a `start` that lands in a later element, so `a = start` is guaranteed to exceed `sge-\u003elength` with no race, timing, or memory-layout dependency.\nPR:L - Setting up the sockmap and SK_MSG program requires CAP_BPF and CAP_NET_ADMIN, but `bpf_token_capable()` grants these at `ns_capable()` level inside a user namespace via delegated BPF tokens, and both capabilities are routinely handed to container workloads, so an ordinary unprivileged-in-init-ns user can reach this path.\nUI:N - No victim action is required \u2014 the attacker loads the SK_MSG program and issues the triggering `sendmsg()` entirely on their own, with no file to open, filesystem to mount, or third party to interact with.\nS:U - The out-of-bounds reads, heap overflow, and scatterlist-ring corruption are all confined to the kernel\u0027s own memory and the socket\u0027s psock state; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted scatterlist entry carries an inflated `length` (up to ~4 GB after the signed-to-unsigned wrap of `b`) and an `offset` past the page, and `tcp_bpf_push()` hands those verbatim to `tcp_sendmsg_locked()` with MSG_SPLICE_PAGES, transmitting arbitrary adjacent kernel heap memory to the socket peer; the `!space` path additionally performs `memcpy(to, from, a)` reading far past the source element.\nI:H - In the no-space branch `memcpy(to, from, a)` and `memcpy(to + a, from + a + pop, b)` write attacker-sized data past an undersized `alloc_pages()` allocation \u2014 a controlled heap buffer overflow \u2014 and the missing `put_page()` plus the stray `sk_msg_iter_var_next()` rotate the entire sg ring, installing stale `struct page *` values that produce refcount imbalance and use-after-free of pages.\nA:H - A negative `b` passed to `memcpy()` as `size_t`, a scatterlist entry pointing far outside its page, and `sk_msg_shift_left()` corrupting the whole fragment ring all lead directly to kernel oops/panic, while the missing `put_page()` permanently leaks a page per popped element."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:46:18.145Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/d3f5763b3062514a234114e97bbde74d8d702449"
            },
            {
              "url": "https://git.kernel.org/stable/c/d26d977633d1d0b8bf9407278189bd0a8d973323"
            },
            {
              "url": "https://git.kernel.org/stable/c/e1f54c61c4c9a5244eb8159dce60d248f7d97b32"
            },
            {
              "url": "https://git.kernel.org/stable/c/f58d3aa457e77a3d9b3df2ab081dcf9950f6029f"
            },
            {
              "url": "https://git.kernel.org/stable/c/98c7ea7d11f2588e8197db042e0291e4ac8f8346"
            },
            {
              "url": "https://git.kernel.org/stable/c/785180bed9879680d8e5c5e1b54c8ae8d948f4c8"
            },
            {
              "url": "https://git.kernel.org/stable/c/275a9f3ef8fabb0cb282a62b9e164dedba7284c5"
            },
            {
              "url": "https://git.kernel.org/stable/c/5d609ba262475db450ba69b8e8a557bd768ac07a"
            }
          ],
          "title": "bpf, sockmap: Several fixes to bpf_msg_pop_data",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-56720",
        "datePublished": "2024-12-29T11:29:58.345Z",
        "dateReserved": "2024-12-27T15:00:39.858Z",
        "dateUpdated": "2026-08-05T11:46:18.145Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.