CVE-2024-47749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-47749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.961Z", "datePublished": "2024-10-21T12:14:15.126Z", "dateUpdated": "2026-08-05T11:39:57.111Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:57.111Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable handlers process `CPL_ACT_ESTABLISH`/`CPL_ACT_OPEN_RPL` that the Chelsio TOE emits in direct response to a remote peer's TCP handshake behavior (SYN-ACK, RST, timeout, 4-tuple collision), so a remote iWARP peer or off-path RST injector controls which CPL arrives and when it races the driver's atid teardown. iWARP clients (NVMe-oF/RDMA, NFS/RDMA, iSER, SMB Direct) connect out across routed networks, making this remotely reachable.\nAC:L - The remote peer controls the timing of its handshake response and can stall until the ep timer fires (`process_timeout()` \u2192 `c4iw_ep_disconnect()` in the `CONNECTING` state) before completing or resetting, so it controls both sides of the race and can retry indefinitely at no cost. Atid-table exhaustion, which makes the freed slot read back as NULL, is likewise inducible by flooding concurrent connects.\nPR:N - `act_establish()` and `act_open_rpl()` run at TCP handshake completion/failure, long before MPA negotiation or any credential exchange, so the peer driving the condition is entirely unauthenticated. No privileges on the target are needed for the remote side of the attack.\nUI:N - No victim action is required \u2014 the connection attempts are made by already-running RDMA ULPs or reconnect loops, and the CPL processing happens asynchronously in the `iw_cxgb4` workqueue.\nS:U - The NULL dereference crashes the kernel that contains the flaw; no security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The dereference is of a NULL `struct c4iw_ep *` at small member offsets (`com.mutex`, `dst`, `com.local_addr`), all below `mmap_min_addr`, so it faults immediately with no attacker-mapped page and yields no read primitive or information disclosure.\nI:N - No memory is written through the NULL pointer before the fault, and the bug provides no write primitive or control-flow hijack \u2014 it is a pure crash.\nA:H - The dereference produces a kernel oops in workqueue context, which is a full panic on `panic_on_oops` systems; even absent that, the ordered `iw_cxgb4` workqueue is wedged, stalling all RDMA connection management for the adapter."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "versions": [{"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b12e25d91c7f97958341538c7dc63ee49d01548f", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "4e1fe68d695af367506ea3c794c5969630f21697", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "dd598ac57dcae796cb58551074660c39b43fb155", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b11318dc8a1ec565300bb1a9073095af817cc508", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "39cb9f39913566ec5865581135f3e8123ad1aee1", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "0d50ae281a1712b9b2ca72830a96b8f11882358d", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "54aaa3ed40972511e423b604324b881425b9ff1e", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b9c94c8ba5a713817cffd74c4bacc05187469624", "status": "affected", "versionType": "git"}, {"version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "e766e6a92410ca269161de059fff0843b8ddd65f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "versions": [{"version": "2.6.35", "status": "affected"}, {"version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.19.323"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.4.285"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.1.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.6.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.10.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.11.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b12e25d91c7f97958341538c7dc63ee49d01548f"}, {"url": "https://git.kernel.org/stable/c/4e1fe68d695af367506ea3c794c5969630f21697"}, {"url": "https://git.kernel.org/stable/c/dd598ac57dcae796cb58551074660c39b43fb155"}, {"url": "https://git.kernel.org/stable/c/b11318dc8a1ec565300bb1a9073095af817cc508"}, {"url": "https://git.kernel.org/stable/c/39cb9f39913566ec5865581135f3e8123ad1aee1"}, {"url": "https://git.kernel.org/stable/c/0d50ae281a1712b9b2ca72830a96b8f11882358d"}, {"url": "https://git.kernel.org/stable/c/54aaa3ed40972511e423b604324b881425b9ff1e"}, {"url": "https://git.kernel.org/stable/c/b9c94c8ba5a713817cffd74c4bacc05187469624"}, {"url": "https://git.kernel.org/stable/c/e766e6a92410ca269161de059fff0843b8ddd65f"}], "title": "RDMA/cxgb4: Added NULL check for lookup_atid", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:58:09.975914Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:13.297Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:44.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:44.230Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T12:58:09.975914Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T12:58:13.133Z"}}], "cna": {"title": "RDMA/cxgb4: Added NULL check for lookup_atid", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable handlers process `CPL_ACT_ESTABLISH`/`CPL_ACT_OPEN_RPL` that the Chelsio TOE emits in direct response to a remote peer's TCP handshake behavior (SYN-ACK, RST, timeout, 4-tuple collision), so a remote iWARP peer or off-path RST injector controls which CPL arrives and when it races the driver's atid teardown. iWARP clients (NVMe-oF/RDMA, NFS/RDMA, iSER, SMB Direct) connect out across routed networks, making this remotely reachable.\nAC:L - The remote peer controls the timing of its handshake response and can stall until the ep timer fires (`process_timeout()` \u2192 `c4iw_ep_disconnect()` in the `CONNECTING` state) before completing or resetting, so it controls both sides of the race and can retry indefinitely at no cost. Atid-table exhaustion, which makes the freed slot read back as NULL, is likewise inducible by flooding concurrent connects.\nPR:N - `act_establish()` and `act_open_rpl()` run at TCP handshake completion/failure, long before MPA negotiation or any credential exchange, so the peer driving the condition is entirely unauthenticated. No privileges on the target are needed for the remote side of the attack.\nUI:N - No victim action is required \u2014 the connection attempts are made by already-running RDMA ULPs or reconnect loops, and the CPL processing happens asynchronously in the `iw_cxgb4` workqueue.\nS:U - The NULL dereference crashes the kernel that contains the flaw; no security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The dereference is of a NULL `struct c4iw_ep *` at small member offsets (`com.mutex`, `dst`, `com.local_addr`), all below `mmap_min_addr`, so it faults immediately with no attacker-mapped page and yields no read primitive or information disclosure.\nI:N - No memory is written through the NULL pointer before the fault, and the bug provides no write primitive or control-flow hijack \u2014 it is a pure crash.\nA:H - The dereference produces a kernel oops in workqueue context, which is a full panic on `panic_on_oops` systems; even absent that, the ordered `iw_cxgb4` workqueue is wedged, stalling all RDMA connection management for the adapter."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b12e25d91c7f97958341538c7dc63ee49d01548f", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "4e1fe68d695af367506ea3c794c5969630f21697", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "dd598ac57dcae796cb58551074660c39b43fb155", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b11318dc8a1ec565300bb1a9073095af817cc508", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "39cb9f39913566ec5865581135f3e8123ad1aee1", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "0d50ae281a1712b9b2ca72830a96b8f11882358d", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "54aaa3ed40972511e423b604324b881425b9ff1e", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "b9c94c8ba5a713817cffd74c4bacc05187469624", "versionType": "git"}, {"status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "lessThan": "e766e6a92410ca269161de059fff0843b8ddd65f", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.323", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.285", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.227", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.168", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.113", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.54", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.13", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11.2", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b12e25d91c7f97958341538c7dc63ee49d01548f"}, {"url": "https://git.kernel.org/stable/c/4e1fe68d695af367506ea3c794c5969630f21697"}, {"url": "https://git.kernel.org/stable/c/dd598ac57dcae796cb58551074660c39b43fb155"}, {"url": "https://git.kernel.org/stable/c/b11318dc8a1ec565300bb1a9073095af817cc508"}, {"url": "https://git.kernel.org/stable/c/39cb9f39913566ec5865581135f3e8123ad1aee1"}, {"url": "https://git.kernel.org/stable/c/0d50ae281a1712b9b2ca72830a96b8f11882358d"}, {"url": "https://git.kernel.org/stable/c/54aaa3ed40972511e423b604324b881425b9ff1e"}, {"url": "https://git.kernel.org/stable/c/b9c94c8ba5a713817cffd74c4bacc05187469624"}, {"url": "https://git.kernel.org/stable/c/e766e6a92410ca269161de059fff0843b8ddd65f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.323", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.285", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.227", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.168", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.113", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.54", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.13", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.2", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "2.6.35"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:57.111Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47749", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:39:57.111Z", "dateReserved": "2024-09-30T16:00:12.961Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T12:14:15.126Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b12e25d91c7f97958341538c7dc63ee49d01548f", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "4e1fe68d695af367506ea3c794c5969630f21697", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "dd598ac57dcae796cb58551074660c39b43fb155", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "b11318dc8a1ec565300bb1a9073095af817cc508", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "39cb9f39913566ec5865581135f3e8123ad1aee1", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "0d50ae281a1712b9b2ca72830a96b8f11882358d", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "54aaa3ed40972511e423b604324b881425b9ff1e", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "b9c94c8ba5a713817cffd74c4bacc05187469624", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}, {"lessThan": "e766e6a92410ca269161de059fff0843b8ddd65f", "status": "affected", "version": "cfdda9d764362ab77b11a410bb928400e6520d57", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/cxgb4/cm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"lessThan": "2.6.35", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.323", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.285", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.54", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.13", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "48954B72-B77A-45CD-815C-F0B53A5FA5E1", "versionEndExcluding": "5.10.227", "versionStartIncluding": "2.6.35", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C", "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D01BD22E-ACD1-4618-9D01-6116570BE1EE", "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976", "versionEndExcluding": "6.6.54", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE", "versionEndExcluding": "6.10.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181", "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/cxgb4: Se agreg\u00f3 una comprobaci\u00f3n NULL para lookup_atid La funci\u00f3n lookup_atid() puede devolver NULL si el ATID no es v\u00e1lido o no existe en la tabla de identificadores, lo que podr\u00eda provocar la desreferenciaci\u00f3n de un puntero nulo sin una comprobaci\u00f3n en las funciones `act_establish()` y `act_open_rpl()`. Agregue una comprobaci\u00f3n NULL para evitar la desreferenciaci\u00f3n de punteros nulos. Encontrado por Linux Verification Center (linuxtesting.org) con SVACE."}], "id": "CVE-2024-47749", "lastModified": "2026-08-04T11:20:48.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47749", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-21T12:58:09.975914Z", "version": "2.0.3"}}]}, "published": "2024-10-21T13:15:04.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d50ae281a1712b9b2ca72830a96b8f11882358d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/39cb9f39913566ec5865581135f3e8123ad1aee1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e1fe68d695af367506ea3c794c5969630f21697"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/54aaa3ed40972511e423b604324b881425b9ff1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b11318dc8a1ec565300bb1a9073095af817cc508"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b12e25d91c7f97958341538c7dc63ee49d01548f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9c94c8ba5a713817cffd74c4bacc05187469624"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd598ac57dcae796cb58551074660c39b43fb155"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e766e6a92410ca269161de059fff0843b8ddd65f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/cxgb4: Added NULL check for lookup_atid", "id": "2320196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320196"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/cxgb4: Added NULL check for lookup_atid\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\nFound by Linux Verification Center (linuxtesting.org) with SVACE."], "name": "CVE-2024-47749", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-47749\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47749\nhttps://lore.kernel.org/linux-cve-announce/2024102112-CVE-2024-47749-c227@gregkh/T"], "threat_severity": "Moderate"}

{}