Security readout for executives and security teams
Plain-English summary
A Linux Smack labeling flaw can mislabel return traffic on TCP/IPv4 connections. This may let a service under one security label send data to another label without the required authorization, undermining confidentiality and integrity controls. Systems not using Smack for labeled network enforcement are unlikely to be exposed.
Executive priority
Treat as urgent where Smack enforces sensitive network separation because the flaw can bypass confidentiality and integrity boundaries remotely. For systems without active Smack-labeled networking, priority can be lower after confirming non-exposure. Require owners to document applicability and vendor-patch status.
Technical view
Smack incorrectly mirrored the incoming peer label onto returned TCP/IPv4 packets instead of applying the responder's label. Consequently, traffic from label “bar” could carry label “foo,” bypassing an intended write restriction. The source reports equivalent DCCP behavior and says the issue first appeared in Linux 2.6.29.4.
Likely exposure
Exposure is concentrated in Linux systems with Smack active and relied upon for CIPSO-based network separation over TCP/IPv4; DCCP may also be affected. The supplied version data lists multiple kernel branches through 6.11 as affected, but does not provide sufficiently clear distribution-specific fixed-version mapping.
Exploitation context
The supplied CVSS is 9.1 and describes network-reachable, low-complexity exploitation without privileges or user interaction. However, exploitation requires a relevant Smack-labeled networking configuration and reachable service. The bundle states this CVE is not in KEV and provides no evidence of active exploitation.
Researcher notes
The defect concerns incorrect security-label propagation, not memory corruption. The source demonstrates an authorization bypass caused by response packets retaining the initiator's label. Stable-kernel commits are supplied, but exact affected and fixed package versions should be resolved through the relevant Linux distributor. No exploit campaign or public weaponization evidence is provided.
Mitigation direction
- Identify systems using Smack and CIPSO-based labeled networking.
- Apply a vendor-supported kernel containing the referenced stable fix.
- Prioritize exposed services crossing Smack label boundaries.
- Check distribution advisories for exact fixed package versions.
- Restrict affected labeled network paths until updates are validated.
Validation and detection
- Confirm whether Smack is active on each Linux host.
- Inventory kernel and distribution package versions against vendor advisories.
- Verify the installed kernel includes the applicable referenced fix.
- Test that response packets carry the responder's expected Smack label.
- Confirm unauthorized cross-label writes are denied after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-47659 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2LinuxVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8CVE reference, Linux
- https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671CVE reference, Linux
- https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670CVE reference, Linux
- https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2cCVE reference, Linux
- https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9CVE reference, Linux
- https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebffCVE reference, Linux
- https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070fCVE reference, Linux
- https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.