CVE-2024-47678 (GCVE-0-2024-47678)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:38
VLAI?
Title
icmp: change the order of rate limits
Summary
In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1) host wide ratelimit (icmp_global_allow()) 2) Per destination ratelimit (inetpeer based) In order to avoid side-channels attacks, we need to apply the per destination check first. This patch makes the following change : 1) icmp_global_allow() checks if the host wide limit is reached. But credits are not yet consumed. This is deferred to 3) 2) The per destination limit is checked/updated. This might add a new node in inetpeer tree. 3) icmp_global_consume() consumes tokens if prior operations succeeded. This means that host wide ratelimit is still effective in keeping inetpeer tree small even under DDOS. As a bonus, I removed icmp_global.lock as the fast path can use a lock-free operation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4cdf507d54525842dfd9f6313fdafba039084046 , < 997ba8889611891f91e8ad83583466aeab6239a3 (git)
Affected: 4cdf507d54525842dfd9f6313fdafba039084046 , < 662ec52260cc07b9ae53ecd3925183c29d34288b (git)
Affected: 4cdf507d54525842dfd9f6313fdafba039084046 , < a7722921adb046e3836eb84372241f32584bdb07 (git)
Affected: 4cdf507d54525842dfd9f6313fdafba039084046 , < 483397b4ba280813e4a9c161a0a85172ddb43d19 (git)
Affected: 4cdf507d54525842dfd9f6313fdafba039084046 , < 8c2bd38b95f75f3d2a08c93e35303e26d480d24e (git)
Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47678",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:07:41.965400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:17.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:20:43.545Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/icmp.c",
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "997ba8889611891f91e8ad83583466aeab6239a3",
              "status": "affected",
              "version": "4cdf507d54525842dfd9f6313fdafba039084046",
              "versionType": "git"
            },
            {
              "lessThan": "662ec52260cc07b9ae53ecd3925183c29d34288b",
              "status": "affected",
              "version": "4cdf507d54525842dfd9f6313fdafba039084046",
              "versionType": "git"
            },
            {
              "lessThan": "a7722921adb046e3836eb84372241f32584bdb07",
              "status": "affected",
              "version": "4cdf507d54525842dfd9f6313fdafba039084046",
              "versionType": "git"
            },
            {
              "lessThan": "483397b4ba280813e4a9c161a0a85172ddb43d19",
              "status": "affected",
              "version": "4cdf507d54525842dfd9f6313fdafba039084046",
              "versionType": "git"
            },
            {
              "lessThan": "8c2bd38b95f75f3d2a08c93e35303e26d480d24e",
              "status": "affected",
              "version": "4cdf507d54525842dfd9f6313fdafba039084046",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/ipv4/icmp.c",
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: change the order of rate limits\n\nICMP messages are ratelimited :\n\nAfter the blamed commits, the two rate limiters are applied in this order:\n\n1) host wide ratelimit (icmp_global_allow())\n\n2) Per destination ratelimit (inetpeer based)\n\nIn order to avoid side-channels attacks, we need to apply\nthe per destination check first.\n\nThis patch makes the following change :\n\n1) icmp_global_allow() checks if the host wide limit is reached.\n   But credits are not yet consumed. This is deferred to 3)\n\n2) The per destination limit is checked/updated.\n   This might add a new node in inetpeer tree.\n\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\n\nThis means that host wide ratelimit is still effective\nin keeping inetpeer tree small even under DDOS.\n\nAs a bonus, I removed icmp_global.lock as the fast path\ncan use a lock-free operation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:38:38.468Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07"
        },
        {
          "url": "https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e"
        }
      ],
      "title": "icmp: change the order of rate limits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47678",
    "datePublished": "2024-10-21T11:53:21.814Z",
    "dateReserved": "2024-09-30T16:00:12.939Z",
    "dateUpdated": "2026-05-11T20:38:38.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47678",
      "date": "2026-05-24",
      "epss": "0.00012",
      "percentile": "0.01737"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.18\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"FBD751AA-4593-4525-B2FB-57EAC7F81608\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nicmp: change the order of rate limits\\n\\nICMP messages are ratelimited :\\n\\nAfter the blamed commits, the two rate limiters are applied in this order:\\n\\n1) host wide ratelimit (icmp_global_allow())\\n\\n2) Per destination ratelimit (inetpeer based)\\n\\nIn order to avoid side-channels attacks, we need to apply\\nthe per destination check first.\\n\\nThis patch makes the following change :\\n\\n1) icmp_global_allow() checks if the host wide limit is reached.\\n   But credits are not yet consumed. This is deferred to 3)\\n\\n2) The per destination limit is checked/updated.\\n   This might add a new node in inetpeer tree.\\n\\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\\n\\nThis means that host wide ratelimit is still effective\\nin keeping inetpeer tree small even under DDOS.\\n\\nAs a bonus, I removed icmp_global.lock as the fast path\\ncan use a lock-free operation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: icmp: cambia el orden de los l\\u00edmites de velocidad Los mensajes ICMP est\\u00e1n limitados por velocidad: despu\\u00e9s de las confirmaciones culpables, se aplican los dos limitadores de velocidad en este orden: 1) l\\u00edmite de velocidad de todo el host (icmp_global_allow()) 2) l\\u00edmite de velocidad por destino (basado en inetpeer) Para evitar ataques de canales secundarios, primero debemos aplicar la comprobaci\\u00f3n por destino. Este parche realiza el siguiente cambio: 1) icmp_global_allow() comprueba si se ha alcanzado el l\\u00edmite de todo el host. Pero a\\u00fan no se han consumido los cr\\u00e9ditos. Esto se pospone a 3) 2) Se comprueba/actualiza el l\\u00edmite por destino. Esto podr\\u00eda agregar un nuevo nodo en el \\u00e1rbol inetpeer. 3) icmp_global_consume() consume tokens si las operaciones anteriores tuvieron \\u00e9xito. Esto significa que el l\\u00edmite de velocidad de todo el host sigue siendo eficaz para mantener peque\\u00f1o el \\u00e1rbol inetpeer incluso bajo DDOS. Como beneficio adicional, elimin\\u00e9 icmp_global.lock ya que la ruta r\\u00e1pida puede usar una operaci\\u00f3n sin bloqueo.\"}]",
      "id": "CVE-2024-47678",
      "lastModified": "2024-10-23T17:58:08.720",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T12:15:04.837",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-203\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47678\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:04.837\",\"lastModified\":\"2025-11-03T23:16:15.597\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nicmp: change the order of rate limits\\n\\nICMP messages are ratelimited :\\n\\nAfter the blamed commits, the two rate limiters are applied in this order:\\n\\n1) host wide ratelimit (icmp_global_allow())\\n\\n2) Per destination ratelimit (inetpeer based)\\n\\nIn order to avoid side-channels attacks, we need to apply\\nthe per destination check first.\\n\\nThis patch makes the following change :\\n\\n1) icmp_global_allow() checks if the host wide limit is reached.\\n   But credits are not yet consumed. This is deferred to 3)\\n\\n2) The per destination limit is checked/updated.\\n   This might add a new node in inetpeer tree.\\n\\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\\n\\nThis means that host wide ratelimit is still effective\\nin keeping inetpeer tree small even under DDOS.\\n\\nAs a bonus, I removed icmp_global.lock as the fast path\\ncan use a lock-free operation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: icmp: cambia el orden de los l\u00edmites de velocidad Los mensajes ICMP est\u00e1n limitados por velocidad: despu\u00e9s de las confirmaciones culpables, se aplican los dos limitadores de velocidad en este orden: 1) l\u00edmite de velocidad de todo el host (icmp_global_allow()) 2) l\u00edmite de velocidad por destino (basado en inetpeer) Para evitar ataques de canales secundarios, primero debemos aplicar la comprobaci\u00f3n por destino. Este parche realiza el siguiente cambio: 1) icmp_global_allow() comprueba si se ha alcanzado el l\u00edmite de todo el host. Pero a\u00fan no se han consumido los cr\u00e9ditos. Esto se pospone a 3) 2) Se comprueba/actualiza el l\u00edmite por destino. Esto podr\u00eda agregar un nuevo nodo en el \u00e1rbol inetpeer. 3) icmp_global_consume() consume tokens si las operaciones anteriores tuvieron \u00e9xito. Esto significa que el l\u00edmite de velocidad de todo el host sigue siendo eficaz para mantener peque\u00f1o el \u00e1rbol inetpeer incluso bajo DDOS. Como beneficio adicional, elimin\u00e9 icmp_global.lock ya que la ruta r\u00e1pida puede usar una operaci\u00f3n sin bloqueo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"FBD751AA-4593-4525-B2FB-57EAC7F81608\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47678\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:07:41.965400Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:07:45.359Z\"}}], \"cna\": {\"title\": \"icmp: change the order of rate limits\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"997ba8889611891f91e8ad83583466aeab6239a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"662ec52260cc07b9ae53ecd3925183c29d34288b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"a7722921adb046e3836eb84372241f32584bdb07\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"483397b4ba280813e4a9c161a0a85172ddb43d19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"8c2bd38b95f75f3d2a08c93e35303e26d480d24e\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/icmp.c\", \"net/ipv6/icmp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/icmp.c\", \"net/ipv6/icmp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3\"}, {\"url\": \"https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b\"}, {\"url\": \"https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07\"}, {\"url\": \"https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19\"}, {\"url\": \"https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nicmp: change the order of rate limits\\n\\nICMP messages are ratelimited :\\n\\nAfter the blamed commits, the two rate limiters are applied in this order:\\n\\n1) host wide ratelimit (icmp_global_allow())\\n\\n2) Per destination ratelimit (inetpeer based)\\n\\nIn order to avoid side-channels attacks, we need to apply\\nthe per destination check first.\\n\\nThis patch makes the following change :\\n\\n1) icmp_global_allow() checks if the host wide limit is reached.\\n   But credits are not yet consumed. This is deferred to 3)\\n\\n2) The per destination limit is checked/updated.\\n   This might add a new node in inetpeer tree.\\n\\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\\n\\nThis means that host wide ratelimit is still effective\\nin keeping inetpeer tree small even under DDOS.\\n\\nAs a bonus, I removed icmp_global.lock as the fast path\\ncan use a lock-free operation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:37:04.400Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47678\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:37:04.400Z\", \"dateReserved\": \"2024-09-30T16:00:12.939Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:21.814Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.