Security readout for executives and security teams
Plain-English summary
A Linux netfilter flaw can make the kernel read beyond a supplied buffer while processing a socket option. A low-privileged local actor could potentially expose sensitive kernel memory or crash the host. The supplied scoring indicates no integrity impact and a local, rather than remote, attack vector.
Executive priority
Accelerate remediation on shared servers, container platforms, and systems running untrusted workloads because compromise could disclose memory or interrupt service. Treat this as important kernel maintenance, not an internet-wide emergency: the supplied CVSS vector requires local access, and active exploitation is not documented.
Technical view
The netfilter setsockopt path failed to validate optlen before copying user-provided data. KASAN observed a 96-byte slab out-of-bounds read from a one-byte allocation in do_replace, reached through do_ipt_set_ctl and nf_setsockopt. Referenced Linux stable commits add the required length validation.
Likely exposure
Exposure centers on Linux systems whose kernels lack the referenced fix or a distribution backport. Risk is greater where untrusted local users or workloads can access relevant networking interfaces. Internet reachability alone does not establish exposure. The supplied version representation is ambiguous, so assess distribution packages and backports rather than version strings alone.
Exploitation context
The bundle marks this CVE as absent from KEV, and no supplied source reports active exploitation or public weaponization. Evidence is limited to syzbot and KASAN findings demonstrating an out-of-bounds kernel read. Practical exploitation beyond triggering memory disclosure or host disruption is not established by the supplied material.
Researcher notes
The report shows a 96-byte read from a one-byte kmalloc object after BPF-related setsockopt handling, with the fault in IPv4 ip_tables replacement processing. The record does not establish code execution or integrity loss. Because its affected-version data is unclear, confirm remediation through stable commit ancestry or vendor backport documentation.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced netfilter input-length validation fix.
- Prioritize multi-user, container, and BPF-enabled hosts with untrusted local workloads.
- If updating is delayed, follow distribution guidance and restrict untrusted local access until remediation.
- Review relevant Debian, appliance, or equipment-vendor advisories before applying product-specific updates.
Validation and detection
- Inventory running kernel versions and map them to distribution advisories for CVE-2024-35896.
- Confirm the kernel includes an applicable stable commit or explicitly documented vendor backport.
- Reboot updated systems and verify the running kernel, not merely the installed package, is remediated.
- Review whether untrusted local users or workloads can reach relevant netfilter socket-option paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35896 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0f038242b77ddfc505bf4163d4904c1abd2e74d6CVE reference, Linux
- https://git.kernel.org/stable/c/440e948cf0eff32cfe322dcbca3f2525354b159bCVE reference, Linux
- https://git.kernel.org/stable/c/18aae2cb87e5faa9c5bd865260ceadac60d5a6c5CVE reference, Linux
- https://git.kernel.org/stable/c/81d51b9b7c95e791ba3c1a2dd77920a9d3b3f525CVE reference, Linux
- https://git.kernel.org/stable/c/58f2bfb789e6bd3bc24a2c9c1580f3c67aec3018CVE reference, Linux
- https://git.kernel.org/stable/c/0c83842df40f86e529db6842231154772c20edccCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20250321-0004/CVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.