Security readout for executives and security teams
Plain-English summary
A local, low-privileged user could trigger an out-of-bounds kernel memory read through AF_XDP socket option handling. This may expose sensitive kernel information or disrupt the system. The supplied evidence does not show remote or active exploitation.
Executive priority
Prioritize remediation on multi-user systems, shared compute, and hosts running untrusted workloads. The issue requires local low-privileged access, reducing internet-facing urgency, but potential confidentiality and availability impact makes routine deferral inappropriate. Use vendor package guidance because the supplied version ranges are incomplete.
Technical view
xsk_setsockopt() failed to validate optlen before reading a four-byte value for XDP_UMEM_FILL_RING or XDP_COMPLETION_RING. A shorter allocation could therefore cause a slab out-of-bounds read. syzbot reproduced the flaw under KASAN. Linux stable commits add the missing length validation.
Likely exposure
Exposure applies to Linux systems within vendor-confirmed affected kernel branches where a low-privileged local actor can reach the vulnerable interface. The supplied version data spans 4.18 through 6.9 but does not preserve enough range detail for reliable package-level decisions.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Available evidence describes a syzbot-generated KASAN failure and corrective kernel commits, not a weaponized or remotely exploitable attack.
Researcher notes
The observed failure was a four-byte read beyond a two-byte allocation in xsk_setsockopt(), reached through setsockopt processing. The fix validates optlen for XDP_UMEM_FILL_RING and XDP_COMPLETION_RING. The sources do not establish practical data disclosure, reliable denial of service, privilege escalation, or exploitation in production.
Mitigation direction
- Install the distribution or appliance kernel update containing the relevant Linux stable fix.
- Reboot systems when required so the corrected kernel becomes active.
- Confirm exact affected and fixed package versions through the applicable vendor advisory.
- Until patched, reduce untrusted local access and workload execution on potentially affected hosts.
Validation and detection
- Inventory installed and actively running kernel versions across Linux systems.
- Map each kernel package to its distribution or appliance vendor advisory.
- Verify the deployed source includes optlen validation for both affected AF_XDP ring options.
- Confirm systems booted into the updated kernel after maintenance.
- Review monitoring for unexplained kernel crashes or KASAN out-of-bounds reports involving xsk_setsockopt.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-35976 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N1.45.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fdCVE reference, Linux
- https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306dCVE reference, Linux
- https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417CVE reference, Linux
- https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922CVE reference, Linux
- https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aaCVE reference, Linux
- https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10cCVE reference, Linux
- https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6CVE reference, Linux
- https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-613116.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.