Security readout for executives and security teams
Plain-English summary
A flaw in Linux local Unix-domain socket handling can reuse memory after it has been freed. A locally authenticated, low-privilege process may trigger a kernel crash or potentially affect confidentiality and integrity. The supplied CVSS 3.1 score is 7.8. Prioritize shared or sensitive Linux systems where untrusted local code runs.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on shared compute, development, and other systems permitting untrusted local execution. It is less urgent for tightly controlled hosts without such access, but still warrants normal security patching. There is no supplied evidence of active exploitation.
Technical view
The AF_UNIX stream receive path mishandles consumed out-of-band socket buffers. manage_oob() can return another OOB buffer without clearing the tracked pointer, allowing unix_stream_recv_urg() to access freed memory. syzbot reproduced the use-after-free under KASAN. The resolution adds another OOB check, including analogous SIOCATMARK handling, with a regression self-test.
Likely exposure
Exposure requires local, low-privileged access and crafted AF_UNIX stream operations using out-of-band data; no user interaction is required. The bundle identifies Linux 6.10 and 6.11.2 among affected version data, but its version-range formatting is ambiguous. Confirm exposure through distribution advisories, kernel changelogs, and backport status rather than version numbers alone.
Exploitation context
The supplied evidence documents a syzbot-triggered KASAN use-after-free, not real-world exploitation. The CVE is not listed as KEV in the bundle. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the sources do not establish a public exploit or demonstrated privilege escalation.
Researcher notes
The defect was exposed after commit 8594d9b85c07 changed OOB buffer reference handling. The important condition is a consumed OOB buffer followed by another OOB buffer encountered during normal receive processing, leaving oob_skb stale. Source evidence is strong for the memory-safety bug and fix, but incomplete regarding practical exploitation and precise downstream version ranges.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix or distribution backport.
- Reboot into the updated kernel after installation; installing packages alone may leave the vulnerable kernel running.
- If updates are unavailable, obtain product-specific mitigation guidance from the Linux distribution vendor.
- Prioritize multi-user systems and hosts that execute untrusted local workloads.
Validation and detection
- Record the running kernel release and package build on each Linux host.
- Check distribution advisories and changelogs for CVE-2024-47711 or the cited fix commits.
- Confirm the running kernel, not merely an installed kernel, contains the backport.
- Use vendor regression tests or the upstream self-test in an isolated environment.
- Review kernel crash telemetry for AF_UNIX, unix_stream_recv_urg, or KASAN use-after-free signatures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-47711 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4a7f9a2591a923bdde4bd7eac33490b6ae3b257cCVE reference, Linux
- https://git.kernel.org/stable/c/5aa57d9f2d5311f19434d95b2a81610aa263e23bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.