cve-2024-47678
Vulnerability from cvelistv5
Published
2024-10-21 11:53
Modified
2024-12-19 09:25
Severity ?
EPSS score ?
0.02% (0.03767)
Summary
In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1) host wide ratelimit (icmp_global_allow()) 2) Per destination ratelimit (inetpeer based) In order to avoid side-channels attacks, we need to apply the per destination check first. This patch makes the following change : 1) icmp_global_allow() checks if the host wide limit is reached. But credits are not yet consumed. This is deferred to 3) 2) The per destination limit is checked/updated. This might add a new node in inetpeer tree. 3) icmp_global_consume() consumes tokens if prior operations succeeded. This means that host wide ratelimit is still effective in keeping inetpeer tree small even under DDOS. As a bonus, I removed icmp_global.lock as the fast path can use a lock-free operation.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07Patch
Impacted products
Vendor Product Version
Linux Linux Version: 4cdf507d54525842dfd9f6313fdafba039084046
Version: 4cdf507d54525842dfd9f6313fdafba039084046
Version: 4cdf507d54525842dfd9f6313fdafba039084046
Version: 4cdf507d54525842dfd9f6313fdafba039084046
Version: 4cdf507d54525842dfd9f6313fdafba039084046
 Create a notification for this product.
   Linux Linux Version: 3.18
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-47678",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-21T13:07:41.965400Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-21T13:14:17.106Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "include/net/ip.h",
                  "net/ipv4/icmp.c",
                  "net/ipv6/icmp.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "997ba8889611891f91e8ad83583466aeab6239a3",
                     status: "affected",
                     version: "4cdf507d54525842dfd9f6313fdafba039084046",
                     versionType: "git",
                  },
                  {
                     lessThan: "662ec52260cc07b9ae53ecd3925183c29d34288b",
                     status: "affected",
                     version: "4cdf507d54525842dfd9f6313fdafba039084046",
                     versionType: "git",
                  },
                  {
                     lessThan: "a7722921adb046e3836eb84372241f32584bdb07",
                     status: "affected",
                     version: "4cdf507d54525842dfd9f6313fdafba039084046",
                     versionType: "git",
                  },
                  {
                     lessThan: "483397b4ba280813e4a9c161a0a85172ddb43d19",
                     status: "affected",
                     version: "4cdf507d54525842dfd9f6313fdafba039084046",
                     versionType: "git",
                  },
                  {
                     lessThan: "8c2bd38b95f75f3d2a08c93e35303e26d480d24e",
                     status: "affected",
                     version: "4cdf507d54525842dfd9f6313fdafba039084046",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "include/net/ip.h",
                  "net/ipv4/icmp.c",
                  "net/ipv6/icmp.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "3.18",
                  },
                  {
                     lessThan: "3.18",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.113",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.54",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.10.*",
                     status: "unaffected",
                     version: "6.10.13",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.11.*",
                     status: "unaffected",
                     version: "6.11.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.12",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: change the order of rate limits\n\nICMP messages are ratelimited :\n\nAfter the blamed commits, the two rate limiters are applied in this order:\n\n1) host wide ratelimit (icmp_global_allow())\n\n2) Per destination ratelimit (inetpeer based)\n\nIn order to avoid side-channels attacks, we need to apply\nthe per destination check first.\n\nThis patch makes the following change :\n\n1) icmp_global_allow() checks if the host wide limit is reached.\n   But credits are not yet consumed. This is deferred to 3)\n\n2) The per destination limit is checked/updated.\n   This might add a new node in inetpeer tree.\n\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\n\nThis means that host wide ratelimit is still effective\nin keeping inetpeer tree small even under DDOS.\n\nAs a bonus, I removed icmp_global.lock as the fast path\ncan use a lock-free operation.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:25:44.135Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3",
            },
            {
               url: "https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b",
            },
            {
               url: "https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07",
            },
            {
               url: "https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19",
            },
            {
               url: "https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e",
            },
         ],
         title: "icmp: change the order of rate limits",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-47678",
      datePublished: "2024-10-21T11:53:21.814Z",
      dateReserved: "2024-09-30T16:00:12.939Z",
      dateUpdated: "2024-12-19T09:25:44.135Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-47678\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:04.837\",\"lastModified\":\"2024-10-23T17:58:08.720\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nicmp: change the order of rate limits\\n\\nICMP messages are ratelimited :\\n\\nAfter the blamed commits, the two rate limiters are applied in this order:\\n\\n1) host wide ratelimit (icmp_global_allow())\\n\\n2) Per destination ratelimit (inetpeer based)\\n\\nIn order to avoid side-channels attacks, we need to apply\\nthe per destination check first.\\n\\nThis patch makes the following change :\\n\\n1) icmp_global_allow() checks if the host wide limit is reached.\\n   But credits are not yet consumed. This is deferred to 3)\\n\\n2) The per destination limit is checked/updated.\\n   This might add a new node in inetpeer tree.\\n\\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\\n\\nThis means that host wide ratelimit is still effective\\nin keeping inetpeer tree small even under DDOS.\\n\\nAs a bonus, I removed icmp_global.lock as the fast path\\ncan use a lock-free operation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: icmp: cambia el orden de los límites de velocidad Los mensajes ICMP están limitados por velocidad: después de las confirmaciones culpables, se aplican los dos limitadores de velocidad en este orden: 1) límite de velocidad de todo el host (icmp_global_allow()) 2) límite de velocidad por destino (basado en inetpeer) Para evitar ataques de canales secundarios, primero debemos aplicar la comprobación por destino. Este parche realiza el siguiente cambio: 1) icmp_global_allow() comprueba si se ha alcanzado el límite de todo el host. Pero aún no se han consumido los créditos. Esto se pospone a 3) 2) Se comprueba/actualiza el límite por destino. Esto podría agregar un nuevo nodo en el árbol inetpeer. 3) icmp_global_consume() consume tokens si las operaciones anteriores tuvieron éxito. Esto significa que el límite de velocidad de todo el host sigue siendo eficaz para mantener pequeño el árbol inetpeer incluso bajo DDOS. Como beneficio adicional, eliminé icmp_global.lock ya que la ruta rápida puede usar una operación sin bloqueo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"FBD751AA-4593-4525-B2FB-57EAC7F81608\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47678\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:07:41.965400Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:07:45.359Z\"}}], \"cna\": {\"title\": \"icmp: change the order of rate limits\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"997ba8889611891f91e8ad83583466aeab6239a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"662ec52260cc07b9ae53ecd3925183c29d34288b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"a7722921adb046e3836eb84372241f32584bdb07\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"483397b4ba280813e4a9c161a0a85172ddb43d19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cdf507d54525842dfd9f6313fdafba039084046\", \"lessThan\": \"8c2bd38b95f75f3d2a08c93e35303e26d480d24e\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/icmp.c\", \"net/ipv6/icmp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/ip.h\", \"net/ipv4/icmp.c\", \"net/ipv6/icmp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3\"}, {\"url\": \"https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b\"}, {\"url\": \"https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07\"}, {\"url\": \"https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19\"}, {\"url\": \"https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nicmp: change the order of rate limits\\n\\nICMP messages are ratelimited :\\n\\nAfter the blamed commits, the two rate limiters are applied in this order:\\n\\n1) host wide ratelimit (icmp_global_allow())\\n\\n2) Per destination ratelimit (inetpeer based)\\n\\nIn order to avoid side-channels attacks, we need to apply\\nthe per destination check first.\\n\\nThis patch makes the following change :\\n\\n1) icmp_global_allow() checks if the host wide limit is reached.\\n   But credits are not yet consumed. This is deferred to 3)\\n\\n2) The per destination limit is checked/updated.\\n   This might add a new node in inetpeer tree.\\n\\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\\n\\nThis means that host wide ratelimit is still effective\\nin keeping inetpeer tree small even under DDOS.\\n\\nAs a bonus, I removed icmp_global.lock as the fast path\\ncan use a lock-free operation.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:25:44.135Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-47678\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:25:44.135Z\", \"dateReserved\": \"2024-09-30T16:00:12.939Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:21.814Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.