Security readout for executives and security teams
Plain-English summary
A remote client can send untrusted values in a Linux SMC proposal message that may make a server access an incorrect memory address and crash. The supplied CVSS score is 9.1, indicating potentially serious confidentiality and availability impact, although the public description specifically confirms only the possibility of a crash.
Executive priority
Treat this as urgent for SMC-enabled Linux servers reachable by untrusted clients because malformed network input may cause a kernel crash without authentication. Prioritize exposure discovery and supported kernel updates. Lower urgency may be reasonable only after confirming SMC is unused or inaccessible; the supplied version data alone is insufficient for that decision.
Technical view
Linux net/smc did not adequately validate iparea_offset and ipv6_prefixes_cnt before processing an incoming proposal message. An excessive offset could select an incorrect address. The upstream fix validates both fields before use. The supplied affected-version data is ambiguous, so distribution-specific kernel status should be confirmed independently.
Likely exposure
Exposure is most likely on affected Linux servers using the SMC networking subsystem and accepting proposal messages from remote clients. Systems not using SMC may have lower practical exposure. The bundle lists releases from 4.16 through several later kernel lines, but does not provide sufficiently clear range boundaries for definitive fleet matching.
Exploitation context
The vector indicates network reachability, low complexity, no privileges, and no user interaction. However, the bundle does not establish that SMC is exposed by default or widely reachable. This CVE is not listed as KEV, and the provided sources contain no evidence of active exploitation or a public exploit.
Researcher notes
The documented flaw is insufficient validation of two client-controlled proposal fields. The description supports an out-of-bounds address selection and possible crash, but does not explain how the CVSS confidentiality impact would occur. No CWE, exploit evidence, precise affected ranges, or proof that every listed kernel version is vulnerable is supplied.
Mitigation direction
- Install a vendor-supported kernel containing the referenced validation fix or an equivalent distribution backport.
- Prioritize SMC-enabled servers that accept connections from untrusted or less-trusted networks.
- If immediate patching is impossible, consult the Linux distributor for supported interim mitigations.
- Reboot into the updated kernel when required by the distribution's kernel update process.
Validation and detection
- Inventory running kernel versions and identify hosts where the SMC subsystem is enabled or used.
- Confirm each installed kernel package's CVE status through its Linux distribution security guidance.
- Verify the running kernel includes a referenced fix or a documented vendor backport.
- After updating, confirm hosts are running the intended kernel rather than only having it installed.
- Review kernel crash records for unexplained net/smc failures without treating their absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49571 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2LinuxVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/846bada23bfcdeb83621b045ed85dc06c7833ff0CVE reference, Linux
- https://git.kernel.org/stable/c/f10635268a0a49ee902a3b63b5dbb76f4fed498eCVE reference, Linux
- https://git.kernel.org/stable/c/62056d1592e63d85e82357ee2ae6a6a294f440b0CVE reference, Linux
- https://git.kernel.org/stable/c/91a7c27c1444ed4677b83fd5308d2cf03f5f0851CVE reference, Linux
- https://git.kernel.org/stable/c/47ce46349672a7e0c361bfe39ed0b22e824ef4fbCVE reference, Linux
- https://git.kernel.org/stable/c/a29e220d3c8edbf0e1beb0f028878a4a85966556CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.