Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in the software iWARP RDMA driver can access network-device memory after it has been freed. On affected systems, a locally authenticated, low-privileged user could potentially crash the host or compromise confidentiality and integrity. Exposure depends on whether the RDMA/siw component is present and used.
Executive priority
Treat as a high-priority local privilege-boundary risk, especially on shared Linux infrastructure using software iWARP. It is less urgent on systems without RDMA/siw exposure, but version ambiguity warrants vendor confirmation rather than assuming safety.
Technical view
CVE-2024-57857 is a CWE-416 use-after-free caused by incorrectly maintaining a direct siw-to-net_device link. The stale link could trigger a KASAN slab-use-after-free during siw_query_port(). The resolution removes this duplicate linkage and relies on the associated ib_device network-device management.
Likely exposure
The source lists Linux releases including 5.3, 6.12.9, and 6.13 as affected, but provides insufficiently clear version boundaries. Prioritize systems using RDMA/siw where local untrusted users, tenants, containers, or workloads can reach relevant kernel functionality.
Exploitation context
The CVSS 3.1 vector scores this 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The bundle does not establish public exploitation, weaponization, or CISA KEV inclusion.
Researcher notes
The supplied fix removes locally duplicated net_device lifetime management and delegates it to ib_device association handling. Two stable commits are referenced, but the bundle does not clearly map them to every affected or fixed release. No exploit evidence or precise attack preconditions beyond the CVSS vector are provided.
Mitigation direction
- Apply a vendor-supported kernel update containing the appropriate referenced stable fix.
- Confirm the selected package maps to the correct distribution kernel branch.
- Consult Linux distribution guidance where fixed-version information is unclear.
- Prioritize multi-user and shared-compute systems that use RDMA/siw.
Validation and detection
- Inventory running kernel versions and identify systems with RDMA/siw present or enabled.
- Verify the installed kernel includes the applicable stable fix for its branch.
- Review kernel logs for KASAN slab-use-after-free reports involving siw_query_port.
- Retest normal RDMA/siw operation after updating the kernel.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57857 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4eafeb4f021c50d13f199239d913b37de3c83135CVE reference, Linux
- https://git.kernel.org/stable/c/16b87037b48889d21854c8e97aec8a1baf2642b3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.