CVE-2024-41007

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-41007", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.610Z", "datePublished": "2024-07-15T08:48:10.174Z", "dateUpdated": "2026-08-05T11:34:33.523Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:33.523Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: avoid too many retransmit packets\n\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has 'expired'.\n\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk->icsk_user_timeout into account.\n\nBefore blamed commit, the socket would not timeout after\nicsk->icsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\n\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the core TCP stack (net/ipv4/tcp_timer.c) and is driven entirely by a remote peer's advertised window and ACKs; no local access is needed. Any remote TCP peer of a socket with TCP_USER_TIMEOUT set (NFS client transports, ocfs2, BPF-sockops-configured connections, gRPC/Envoy/HAProxy/Redis servers) can trigger it.\nAC:L - The attacker fully controls the trigger \u2014 shrink the receive window to zero (stop reading, or use a custom stack) and keep ACKing the zero-window probes to keep tp->rcv_tstamp fresh so tcp_rtx_probe0_timed_out() never aborts. No race, timing luck, or memory-layout dependency; TCP_USER_TIMEOUT being set is a common attacker-independent deployment property (sunrpc sets it unconditionally), i.e. part of the vulnerable configuration.\nPR:N - No authentication or credentials are required \u2014 establishing a TCP connection and getting unacked data in flight (e.g. a banner or a pre-auth response) is sufficient. Locally the same condition is reachable by any unprivileged user via setsockopt(TCP_USER_TIMEOUT), which has no capability check.\nUI:N - The packet storm is generated autonomously by the kernel retransmit timer once the peer advertises a zero window. No action by any local user or administrator is needed.\nS:U - The CPU, softirq and network-bandwidth exhaustion stay within the affected host's own security authority. No privilege or virtualization boundary is crossed.\nC:N - The bug only causes excessive retransmission of data already queued for and destined to that same peer \u2014 no out-of-bounds read, uninitialized memory, or kernel-pointer exposure. The only extra output is an already-existing net_dbg_ratelimited() message.\nI:N - There is no memory corruption, out-of-bounds write, or type confusion; the emitted packets are legitimate, correctly-formed retransmissions. No kernel or user data is modified.\nA:H - tcp_clamp_rto_to_user_timeout() pins the retransmit timer to 1 jiffy, producing 500\u20131000 packets/sec per socket, each with a tcp_enter_loss() and a __sk_dst_reset() route lookup, and a peer that keeps ACKing probes makes this unbounded in time rather than the 4 minutes noted in the changelog. Scaled across many connections this is a sustained, unauthenticated CPU and link-saturation denial of service, and the socket also silently ignores the TCP_USER_TIMEOUT the application relies on for failure detection."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_timer.c"], "versions": [{"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "d2346fca5bed130dc712f276ac63450201d52969", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "5d7e64d70a11d988553a08239c810a658e841982", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "04317a2471c2f637b4c49cbd0e9c0d04a519f570", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "e113cddefa27bbf5a79f72387b8fbd432a61a466", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "dfcdd7f89e401d2c6616be90c76c2fac3fa98fde", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "66cb64a1d2239cd0309f9b5038b05462570a5be1", "status": "affected", "versionType": "git"}, {"version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "97a9063518f198ec0adb2ecb89789de342bb8283", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_timer.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "4.19.318"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.41"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.9.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"}, {"url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"}, {"url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"}, {"url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"}, {"url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"}, {"url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"}, {"url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"}, {"url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"}], "title": "tcp: avoid too many retransmit packets", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:11.582Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:00:52.460807Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:18.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:11.582Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:00:52.460807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:21.889Z"}}], "cna": {"title": "tcp: avoid too many retransmit packets", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the core TCP stack (net/ipv4/tcp_timer.c) and is driven entirely by a remote peer's advertised window and ACKs; no local access is needed. Any remote TCP peer of a socket with TCP_USER_TIMEOUT set (NFS client transports, ocfs2, BPF-sockops-configured connections, gRPC/Envoy/HAProxy/Redis servers) can trigger it.\nAC:L - The attacker fully controls the trigger \u2014 shrink the receive window to zero (stop reading, or use a custom stack) and keep ACKing the zero-window probes to keep tp->rcv_tstamp fresh so tcp_rtx_probe0_timed_out() never aborts. No race, timing luck, or memory-layout dependency; TCP_USER_TIMEOUT being set is a common attacker-independent deployment property (sunrpc sets it unconditionally), i.e. part of the vulnerable configuration.\nPR:N - No authentication or credentials are required \u2014 establishing a TCP connection and getting unacked data in flight (e.g. a banner or a pre-auth response) is sufficient. Locally the same condition is reachable by any unprivileged user via setsockopt(TCP_USER_TIMEOUT), which has no capability check.\nUI:N - The packet storm is generated autonomously by the kernel retransmit timer once the peer advertises a zero window. No action by any local user or administrator is needed.\nS:U - The CPU, softirq and network-bandwidth exhaustion stay within the affected host's own security authority. No privilege or virtualization boundary is crossed.\nC:N - The bug only causes excessive retransmission of data already queued for and destined to that same peer \u2014 no out-of-bounds read, uninitialized memory, or kernel-pointer exposure. The only extra output is an already-existing net_dbg_ratelimited() message.\nI:N - There is no memory corruption, out-of-bounds write, or type confusion; the emitted packets are legitimate, correctly-formed retransmissions. No kernel or user data is modified.\nA:H - tcp_clamp_rto_to_user_timeout() pins the retransmit timer to 1 jiffy, producing 500\u20131000 packets/sec per socket, each with a tcp_enter_loss() and a __sk_dst_reset() route lookup, and a peer that keeps ACKing probes makes this unbounded in time rather than the 4 minutes noted in the changelog. Scaled across many connections this is a sustained, unauthenticated CPU and link-saturation denial of service, and the socket also silently ignores the TCP_USER_TIMEOUT the application relies on for failure detection."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "d2346fca5bed130dc712f276ac63450201d52969", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "5d7e64d70a11d988553a08239c810a658e841982", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "04317a2471c2f637b4c49cbd0e9c0d04a519f570", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "e113cddefa27bbf5a79f72387b8fbd432a61a466", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "dfcdd7f89e401d2c6616be90c76c2fac3fa98fde", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "66cb64a1d2239cd0309f9b5038b05462570a5be1", "versionType": "git"}, {"status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "lessThan": "97a9063518f198ec0adb2ecb89789de342bb8283", "versionType": "git"}], "programFiles": ["net/ipv4/tcp_timer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.318", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.280", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.222", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.163", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.100", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.41", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.10", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/tcp_timer.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"}, {"url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"}, {"url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"}, {"url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"}, {"url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"}, {"url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"}, {"url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"}, {"url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: avoid too many retransmit packets\n\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has 'expired'.\n\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk->icsk_user_timeout into account.\n\nBefore blamed commit, the socket would not timeout after\nicsk->icsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\n\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.318", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.280", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.222", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.163", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.100", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.41", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.10", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:33.523Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41007", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:34:33.523Z", "dateReserved": "2024-07-12T12:17:45.610Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-15T08:48:10.174Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "d2346fca5bed130dc712f276ac63450201d52969", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "5d7e64d70a11d988553a08239c810a658e841982", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "04317a2471c2f637b4c49cbd0e9c0d04a519f570", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "e113cddefa27bbf5a79f72387b8fbd432a61a466", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "dfcdd7f89e401d2c6616be90c76c2fac3fa98fde", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "66cb64a1d2239cd0309f9b5038b05462570a5be1", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}, {"lessThan": "97a9063518f198ec0adb2ecb89789de342bb8283", "status": "affected", "version": "b701a99e431db784714c32fc6b68123045714679", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.318", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.280", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.222", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.163", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.100", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.41", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EDB3F5FC-7B58-42A1-96EF-E53AF464227C", "versionEndExcluding": "5.4.280", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00696AC5-EE29-437F-97F9-C4D66608B327", "versionEndExcluding": "5.10.222", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD", "versionEndExcluding": "5.15.163", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "100CDF74-4DB5-4FC6-A54B-BDBDB0C27137", "versionEndExcluding": "6.1.100", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96AC42B8-D66D-4AC5-B466-E9BA7910FA29", "versionEndExcluding": "6.6.41", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352", "versionEndExcluding": "6.9.10", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: avoid too many retransmit packets\n\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has 'expired'.\n\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk->icsk_user_timeout into account.\n\nBefore blamed commit, the socket would not timeout after\nicsk->icsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\n\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: evitar demasiados paquetes de retransmisi\u00f3n Si un socket TCP est\u00e1 usando TCP_USER_TIMEOUT y el otro par retrajo su ventana a cero, tcp_retransmit_timer() puede retransmitir un paquete cada dos santiam\u00e9n (2 ms). para HZ=1000), durante aproximadamente 4 minutos despu\u00e9s de que TCP_USER_TIMEOUT haya 'expirado'. La soluci\u00f3n es asegurarse de que tcp_rtx_probe0_timed_out() tenga en cuenta icsk->icsk_user_timeout. Antes de el commit culpable, el socket no expiraba despu\u00e9s de icsk->icsk_user_timeout, sino que usaba un retroceso exponencial est\u00e1ndar para las retransmisiones. Tambi\u00e9n vale la pena se\u00f1alar que antes de commit e89688e3e978 (\"net: tcp: fix unexcepted socket die cuando snd_wnd es 0\"), el problema durar\u00eda 2 minutos en lugar de 4."}], "id": "CVE-2024-41007", "lastModified": "2026-08-04T11:19:15.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41007", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:00:52.460807Z", "version": "2.0.3"}}]}, "published": "2024-07-15T09:15:02.803", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7001", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:10771", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.47.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-04T00:00:00Z"}], "bugzilla": {"description": "kernel: tcp: avoid too many retransmit packets", "id": "2297909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297909"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntcp: avoid too many retransmit packets\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has 'expired'.\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk->icsk_user_timeout into account.\nBefore blamed commit, the socket would not timeout after\nicsk->icsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4.", "A vulnerability was found in the tcp_retransmit_timer function in the Linux kernel's TCP implementation. This issue occurs when a TCP socket uses TCP_USER_TIMEOUT and the peer's window retracts to zero, leading to excessive retransmission of packets every two milliseconds for up to four minutes after the timeout, which can result in network congestion and performance degradation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-41007", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-41007\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41007\nhttps://lore.kernel.org/linux-cve-announce/2024071513-CVE-2024-41007-777c@gregkh/T"], "threat_severity": "Moderate"}

{}