Security readout for executives and security teams
Plain-English summary
A Linux WireGuard flaw can cause unsafe memory reads when handling IPv6 allowed-address data on parisc systems. The supplied record rates potential availability impact as high, but documents kernel warnings rather than a demonstrated outage. Exposure appears concentrated in systems using the parisc architecture, WireGuard, and IPv6 configuration.
Executive priority
Treat as a targeted high-priority kernel update for parisc WireGuard deployments. Validate those systems promptly and remediate through supported kernel packages. For other architectures, verify vendor applicability before escalating broadly; the supplied evidence does not show active exploitation or confirmed cross-platform impact.
Technical view
WireGuard’s allowedips code used aligned 64-bit loads while reading a potentially unaligned 128-bit IPv6 address on parisc. The kernel fix replaces those accesses with get_unaligned_be64(). The supplied CVSS 3.1 score is 7.5 for network-reachable availability impact, although the source description only confirms unaligned-access warnings.
Likely exposure
Highest likelihood is on affected Linux kernels running parisc with WireGuard enabled and IPv6 allowed-IP entries processed. The bundle lists affected Linux versions but provides ambiguous version formatting, so administrators should confirm applicability through their distribution or kernel vendor rather than infer exact vulnerable ranges.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Although the CVSS vector models unauthenticated network access and high availability impact, the technical evidence supplied describes parisc kernel warnings; it does not establish reliable remote denial of service.
Researcher notes
The demonstrated defect is an alignment assumption in WireGuard’s IPv6 allowedips path. The correction uses architecture-safe unaligned big-endian reads. Further analysis should distinguish warning handling from actual service disruption and verify affected version boundaries, because the bundle’s version list is not sufficiently clear for precise range determination.
Mitigation direction
- Update to a vendor-supported kernel release that incorporates the referenced WireGuard fix.
- Prioritize parisc hosts using WireGuard with IPv6 allowed-IP configuration.
- Consult distribution guidance to identify fixed package versions for each deployed kernel line.
- Where updating is delayed, assess whether WireGuard or affected IPv6 configuration can be safely disabled.
Validation and detection
- Inventory kernel versions, CPU architectures, and systems with WireGuard enabled.
- Identify parisc systems configured with IPv6 WireGuard allowed-IP entries.
- Compare installed kernels with vendor advisories or the referenced stable fixes.
- Review kernel logs for WireGuard unaligned-access warnings.
- After updating, confirm the running kernel is the remediated version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ae630de24efb123d7199a43256396d7758f4cb75CVE reference, Linux
- https://git.kernel.org/stable/c/b4764f0ad3d68de8a0b847c05f427afb86dd54e6CVE reference, Linux
- https://git.kernel.org/stable/c/217978a29c6ceca76d3c640bf94bdf50c268d801CVE reference, Linux
- https://git.kernel.org/stable/c/6638a203abad35fa636d59ac47bdbc4bc100fd74CVE reference, Linux
- https://git.kernel.org/stable/c/2fb34bf76431e831f9863cd59adc0bd1f67b0fbfCVE reference, Linux
- https://git.kernel.org/stable/c/948f991c62a4018fb81d85804eeab3029c6209f8CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.