CVE-2024-47739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-47739", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.959Z", "datePublished": "2024-10-21T12:14:08.495Z", "dateUpdated": "2026-08-05T11:39:49.642Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:49.642Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The seq_nr counter is driven by ESP packet processing \u2014 `xfrm_input()` reaches `esp_input` \u2192 `crypto_aead_decrypt` \u2192 pcrypt \u2192 `padata_do_parallel` for every inbound ESP packet, and outbound tunnel traffic burns counters on the encrypt shell, so a remote attacker on an IPsec gateway using pcrypt can drive the 32-bit counter to overflow purely with network traffic.\nAC:L - The attacker needs only to sustain packet/request volume until the 32-bit counter wraps \u2014 entirely under their control, with no race window, no memory-layout dependency, and no unknown target state.\nPR:N - The `padata_do_parallel` call happens before ICV/authentication verification in `xfrm_input()`, so forged ESP packets from an unauthenticated attacker consume sequence numbers; outbound-direction counter consumption requires no credentials or SPI knowledge whatsoever.\nUI:N - The counter advances automatically as the kernel processes attacker-supplied traffic; no victim action of any kind is needed.\nS:U - The stalled reorder list and leaked objects are confined to the kernel's own crypto pipeline; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an ordering/comparison error in list insertion \u2014 nothing is read out of bounds and no kernel memory contents are exposed to the attacker.\nI:N - The mis-sort causes `padata_find_next()` to refuse to dequeue rather than to deliver objects out of order, so no data is modified or corrupted and no control-flow primitive is created.\nA:H - The reorder list deadlocks permanently, hanging every subsequent request through that pcrypt algorithm system-wide (the shell is per-instance, shared by all tfms), leaking each queued skb/request and the `parallel_data` forever \u2014 an irrecoverable IPsec/crypto outage plus unbounded memory exhaustion until reboot."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/padata.c"], "versions": [{"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "46c4079460f4dcaf445860679558eedef4e1bc91", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "72164d5b648951684b1a593996b37a6083c61d7d", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "ab205e1c3846326f162180e56825b4ba38ce9c30", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "1b8cf11b3ca593a8802a51802cd0c28c38501428", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "9e279e6c1f012b82628b89e1b9c65dbefa8ca25a", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "1bd712de96ad7167fe0d608e706cd60587579f16", "status": "affected", "versionType": "git"}, {"version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "9a22b2812393d93d84358a760c347c21939029a6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/padata.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.10.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.15.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.10.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.11.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/46c4079460f4dcaf445860679558eedef4e1bc91"}, {"url": "https://git.kernel.org/stable/c/72164d5b648951684b1a593996b37a6083c61d7d"}, {"url": "https://git.kernel.org/stable/c/ab205e1c3846326f162180e56825b4ba38ce9c30"}, {"url": "https://git.kernel.org/stable/c/1b8cf11b3ca593a8802a51802cd0c28c38501428"}, {"url": "https://git.kernel.org/stable/c/9e279e6c1f012b82628b89e1b9c65dbefa8ca25a"}, {"url": "https://git.kernel.org/stable/c/1bd712de96ad7167fe0d608e706cd60587579f16"}, {"url": "https://git.kernel.org/stable/c/9a22b2812393d93d84358a760c347c21939029a6"}], "title": "padata: use integer wrap around to prevent deadlock on seq_nr overflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:59:27.799629Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:14.713Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:35.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:35.468Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:59:27.799629Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T12:59:30.940Z"}}], "cna": {"title": "padata: use integer wrap around to prevent deadlock on seq_nr overflow", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The seq_nr counter is driven by ESP packet processing \u2014 `xfrm_input()` reaches `esp_input` \u2192 `crypto_aead_decrypt` \u2192 pcrypt \u2192 `padata_do_parallel` for every inbound ESP packet, and outbound tunnel traffic burns counters on the encrypt shell, so a remote attacker on an IPsec gateway using pcrypt can drive the 32-bit counter to overflow purely with network traffic.\nAC:L - The attacker needs only to sustain packet/request volume until the 32-bit counter wraps \u2014 entirely under their control, with no race window, no memory-layout dependency, and no unknown target state.\nPR:N - The `padata_do_parallel` call happens before ICV/authentication verification in `xfrm_input()`, so forged ESP packets from an unauthenticated attacker consume sequence numbers; outbound-direction counter consumption requires no credentials or SPI knowledge whatsoever.\nUI:N - The counter advances automatically as the kernel processes attacker-supplied traffic; no victim action of any kind is needed.\nS:U - The stalled reorder list and leaked objects are confined to the kernel's own crypto pipeline; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an ordering/comparison error in list insertion \u2014 nothing is read out of bounds and no kernel memory contents are exposed to the attacker.\nI:N - The mis-sort causes `padata_find_next()` to refuse to dequeue rather than to deliver objects out of order, so no data is modified or corrupted and no control-flow primitive is created.\nA:H - The reorder list deadlocks permanently, hanging every subsequent request through that pcrypt algorithm system-wide (the shell is per-instance, shared by all tfms), leaking each queued skb/request and the `parallel_data` forever \u2014 an irrecoverable IPsec/crypto outage plus unbounded memory exhaustion until reboot."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "46c4079460f4dcaf445860679558eedef4e1bc91", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "72164d5b648951684b1a593996b37a6083c61d7d", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "ab205e1c3846326f162180e56825b4ba38ce9c30", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "1b8cf11b3ca593a8802a51802cd0c28c38501428", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "9e279e6c1f012b82628b89e1b9c65dbefa8ca25a", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "1bd712de96ad7167fe0d608e706cd60587579f16", "versionType": "git"}, {"status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "lessThan": "9a22b2812393d93d84358a760c347c21939029a6", "versionType": "git"}], "programFiles": ["kernel/padata.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"status": "unaffected", "version": "0", "lessThan": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.227", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.168", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.113", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.54", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.13", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11.2", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/padata.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/46c4079460f4dcaf445860679558eedef4e1bc91"}, {"url": "https://git.kernel.org/stable/c/72164d5b648951684b1a593996b37a6083c61d7d"}, {"url": "https://git.kernel.org/stable/c/ab205e1c3846326f162180e56825b4ba38ce9c30"}, {"url": "https://git.kernel.org/stable/c/1b8cf11b3ca593a8802a51802cd0c28c38501428"}, {"url": "https://git.kernel.org/stable/c/9e279e6c1f012b82628b89e1b9c65dbefa8ca25a"}, {"url": "https://git.kernel.org/stable/c/1bd712de96ad7167fe0d608e706cd60587579f16"}, {"url": "https://git.kernel.org/stable/c/9a22b2812393d93d84358a760c347c21939029a6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.227", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.54", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.13", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.2", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "5.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:49.642Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47739", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:39:49.642Z", "dateReserved": "2024-09-30T16:00:12.959Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T12:14:08.495Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/padata.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "46c4079460f4dcaf445860679558eedef4e1bc91", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "72164d5b648951684b1a593996b37a6083c61d7d", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "ab205e1c3846326f162180e56825b4ba38ce9c30", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "1b8cf11b3ca593a8802a51802cd0c28c38501428", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "9e279e6c1f012b82628b89e1b9c65dbefa8ca25a", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "1bd712de96ad7167fe0d608e706cd60587579f16", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}, {"lessThan": "9a22b2812393d93d84358a760c347c21939029a6", "status": "affected", "version": "bfde23ce200e6d33291d29b9b8b60cc2f30f0805", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/padata.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.54", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.13", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "114E45ED-C336-4B21-B1A8-759F9542EC7C", "versionEndExcluding": "5.10.227", "versionStartIncluding": "5.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C", "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D01BD22E-ACD1-4618-9D01-6116570BE1EE", "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976", "versionEndExcluding": "6.6.54", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE", "versionEndExcluding": "6.10.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181", "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: padata: usar un envoltorio de enteros para evitar un bloqueo en el desbordamiento de seq_nr Al enviar m\u00e1s de 2^32 objetos padata a padata_do_serial, la implementaci\u00f3n de clasificaci\u00f3n actual ordena incorrectamente los objetos padata con seq_nr desbordado, lo que hace que se coloquen antes de los objetos existentes en la lista de reordenamiento. Esto conduce a un bloqueo en el proceso de serializaci\u00f3n ya que padata_find_next no puede coincidir con padata->seq_nr y pd->processed porque la instancia de padata con seq_nr desbordado se seleccionar\u00e1 a continuaci\u00f3n. Para solucionar esto, usamos un envoltorio de enteros sin signo para ordenar correctamente los objetos padata en escenarios con desbordamiento de enteros."}], "id": "CVE-2024-47739", "lastModified": "2026-08-04T11:20:46.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47739", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-21T12:59:27.799629Z", "version": "2.0.3"}}]}, "published": "2024-10-21T13:15:04.017", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b8cf11b3ca593a8802a51802cd0c28c38501428"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bd712de96ad7167fe0d608e706cd60587579f16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46c4079460f4dcaf445860679558eedef4e1bc91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72164d5b648951684b1a593996b37a6083c61d7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a22b2812393d93d84358a760c347c21939029a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e279e6c1f012b82628b89e1b9c65dbefa8ca25a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ab205e1c3846326f162180e56825b4ba38ce9c30"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow", "id": "2320210", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320210"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow.", "A flaw was found in the padata (parallel algorithm data) subsystem in the Linux kernel. An integer overflow can be triggered when processing more than 2^32 (~4GiB) padata objects, causing a deadlock in the serialization process, potentially resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-47739", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-47739\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47739\nhttps://lore.kernel.org/linux-cve-announce/2024102109-CVE-2024-47739-8bc4@gregkh/T"], "threat_severity": "Moderate"}

{}