Security readout for executives and security teams
Plain-English summary
CVE-2024-56703 can crash affected Linux systems under a specific IPv6 routing workload. It matters most for edge routers or appliances with frequent BGP route updates and heavy IPv6 traffic. The business impact is availability loss, not data theft or privilege escalation, based on the provided sources.
Executive priority
Treat as a targeted availability risk for IPv6 routing infrastructure. Patch during the next controlled maintenance window for exposed routers, sooner where crashes would disrupt customer traffic or critical network paths.
Technical view
The Linux IPv6 routing path selection code, fib6_select_path, can enter an infinite loop while traversing multipath sibling routes during concurrent nexthop deletion. The watchdog can treat the resulting soft lockup as a panic. Upstream stable commits apply RCU primitives around affected sibling handling.
Likely exposure
Exposure is most likely on Linux-based routers, network appliances, or servers using IPv6 multipath routing with frequent BGP-driven nexthop churn. Ordinary Linux hosts without dynamic IPv6 routing pressure appear less likely to match the described failure conditions.
Exploitation context
The CVSS vector is local, low complexity, low privilege, and availability-only. KEV is false, and the provided sources do not show active exploitation. The bundled description includes a reproduction scenario using routing-table churn plus heavy IPv6 traffic, but not public exploitation evidence.
Researcher notes
This is CWE-835 in Linux IPv6 route selection. The failure depends on concurrent route sibling deletion during multipath traversal. The source bundle names fixed upstream commits and a reproducer concept, but does not provide enough evidence to claim internet-scale exploitability.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- Prioritize Linux edge routers handling IPv6 BGP or multipath routes.
- Check Debian, Siemens, and Linux vendor advisories for affected package guidance.
- If no patch is available, follow vendor guidance rather than applying ad hoc fixes.
Validation and detection
- Inventory Linux kernels on IPv6 routing systems and network appliances.
- Compare running builds against vendor advisories and referenced stable commits.
- Review logs for watchdog panics or soft lockups mentioning fib6_select_path.
- Confirm patched kernels include the RCU-based fib6_siblings handling fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56703 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2CVE reference, Linux
- https://git.kernel.org/stable/c/52da02521ede55fb86546c3fffd9377b3261b91fCVE reference, Linux
- https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6fCVE reference, Linux
- https://git.kernel.org/stable/c/34a949e7a0869dfa31a40416d2a56973fae1807bCVE reference, Linux
- https://git.kernel.org/stable/c/d9ccb18f83ea2bb654289b6ecf014fd267cc988bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.