CVE-2024-58053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58053", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-06T15:52:09.178Z", "datePublished": "2025-03-06T15:53:57.558Z", "dateUpdated": "2026-10-15T21:51:50.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:29.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we've received. Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection. Whilst the propagation bit is performed, the calls aren't then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The trigger is an unauthenticated rxrpc ABORT packet delivered over UDP to an AF_RXRPC endpoint (kafs binds its callback-manager service to [::]:7001, and client connections accept aborts from the peer), handled entirely in net/rxrpc/io_thread.c \u2192 conn_event.c.\nAC:L - The attacker fully controls both steps \u2014 send a DATA packet to instantiate a service call on a channel, then send a connection-level ABORT \u2014 with no race, no memory-layout dependence, and no reliance on victim state.\nPR:N - The service call is created and attached to conn->channels[] before the rxrpc security challenge/response completes (state SERVICE_UNSECURED/CHALLENGING), and ABORT packets are never authenticated or encrypted, so no credentials of any kind are required.\nUI:N - Exploitation is entirely packet-driven against a listening rxrpc service or an in-flight connection; no action by any local user is needed.\nS:U - The leaked calls, hung RPCs and wedged cleanup path all remain within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a missing rxrpc_poke_call() wake-up; no out-of-bounds read, freed-object read, or pointer disclosure occurs.\nI:N - No memory is corrupted and no attacker-controlled data is written anywhere \u2014 the only effect is that termination processing never runs.\nA:H - In-flight calls hang indefinitely, each aborted connection permanently leaks up to four rxrpc_call objects (plus conn/peer/local refs and queued skbs) that can be accumulated remotely at packet rate until OOM, and rxrpc_destroy_all_calls()'s wait_var_event() then blocks cleanup_net forever, permanently preventing all network-namespace teardown on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "versions": [{"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "9c6702260557c0183d8417c79a37777a3d3e58e8", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "5842ce7b120c65624052a8da04460d35b26caac0", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "96d1d927c4d03ee9dcee7640bca70b74e63504fc", "status": "affected", "versionType": "git"}, {"version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "0e56ebde245e4799ce74d38419426f2a80d39950", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8"}, {"url": "https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0"}, {"url": "https://git.kernel.org/stable/c/96d1d927c4d03ee9dcee7640bca70b74e63504fc"}, {"url": "https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}], "title": "rxrpc: Fix handling of received connection abort", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:09.782449Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:50.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:09.782449Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:10.583Z"}}], "cna": {"title": "rxrpc: Fix handling of received connection abort", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The trigger is an unauthenticated rxrpc ABORT packet delivered over UDP to an AF_RXRPC endpoint (kafs binds its callback-manager service to [::]:7001, and client connections accept aborts from the peer), handled entirely in net/rxrpc/io_thread.c \u2192 conn_event.c.\nAC:L - The attacker fully controls both steps \u2014 send a DATA packet to instantiate a service call on a channel, then send a connection-level ABORT \u2014 with no race, no memory-layout dependence, and no reliance on victim state.\nPR:N - The service call is created and attached to conn->channels[] before the rxrpc security challenge/response completes (state SERVICE_UNSECURED/CHALLENGING), and ABORT packets are never authenticated or encrypted, so no credentials of any kind are required.\nUI:N - Exploitation is entirely packet-driven against a listening rxrpc service or an in-flight connection; no action by any local user is needed.\nS:U - The leaked calls, hung RPCs and wedged cleanup path all remain within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a missing rxrpc_poke_call() wake-up; no out-of-bounds read, freed-object read, or pointer disclosure occurs.\nI:N - No memory is corrupted and no attacker-controlled data is written anywhere \u2014 the only effect is that termination processing never runs.\nA:H - In-flight calls hang indefinitely, each aborted connection permanently leaks up to four rxrpc_call objects (plus conn/peer/local refs and queued skbs) that can be accumulated remotely at packet rate until OOM, and rxrpc_destroy_all_calls()'s wait_var_event() then blocks cleanup_net forever, permanently preventing all network-namespace teardown on the host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "9c6702260557c0183d8417c79a37777a3d3e58e8", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "5842ce7b120c65624052a8da04460d35b26caac0", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "96d1d927c4d03ee9dcee7640bca70b74e63504fc", "versionType": "git"}, {"status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "lessThan": "0e56ebde245e4799ce74d38419426f2a80d39950", "versionType": "git"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.76", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.13", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.2", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8"}, {"url": "https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0"}, {"url": "https://git.kernel.org/stable/c/96d1d927c4d03ee9dcee7640bca70b74e63504fc"}, {"url": "https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we've received. Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection. Whilst the propagation bit is performed, the calls aren't then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.76", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.13", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.2", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "4.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:29.857Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58053", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:50.576Z", "dateReserved": "2025-03-06T15:52:09.178Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-06T15:53:57.558Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9c6702260557c0183d8417c79a37777a3d3e58e8", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "5842ce7b120c65624052a8da04460d35b26caac0", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "96d1d927c4d03ee9dcee7640bca70b74e63504fc", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}, {"lessThan": "0e56ebde245e4799ce74d38419426f2a80d39950", "status": "affected", "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/trace/events/rxrpc.h", "net/rxrpc/conn_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.76", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.13", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4861BDC-5E69-4657-B49D-0B12D497DA9B", "versionEndExcluding": "6.6.76", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2897389C-A8C3-4D69-90F2-E701B3D66373", "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we've received. Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection. Whilst the propagation bit is performed, the calls aren't then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se ha corregido la gesti\u00f3n de la interrupci\u00f3n de la conexi\u00f3n recibida Se ha corregido la gesti\u00f3n de una interrupci\u00f3n de la conexi\u00f3n que hemos recibido. Aunque la interrupci\u00f3n se produce a nivel de conexi\u00f3n, es necesario propagarla a las llamadas de esa conexi\u00f3n. Mientras se realiza el bit de propagaci\u00f3n, las llamadas no se activan para procesar su finalizaci\u00f3n y, como no se recibe ninguna otra entrada, simplemente se cuelgan. Tambi\u00e9n se ha a\u00f1adido alg\u00fan seguimiento para el registro de las interrupciones de la conexi\u00f3n."}], "id": "CVE-2024-58053", "lastModified": "2026-10-15T22:18:05.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58053", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:09.782449Z", "version": "2.0.3"}}]}, "published": "2025-03-06T16:15:51.490", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/96d1d927c4d03ee9dcee7640bca70b74e63504fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rxrpc: Fix handling of received connection abort", "id": "2350369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350369"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: Fix handling of received connection abort\nFix the handling of a connection abort that we've received. Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection. Whilst the propagation bit is performed, the calls aren't then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\nAlso add some tracing for the logging of connection aborts."], "name": "CVE-2024-58053", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58053\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58053\nhttps://lore.kernel.org/linux-cve-announce/2025030605-CVE-2024-58053-3c8d@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:14:00.334734+00:00", "updated": "2025-07-13T11:14:00.334829+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}