Security readout for executives and security teams
Plain-English summary
CVE-2024-57938 is a Linux kernel SCTP flaw where an unusually large autoclose setting can trigger integer overflow. The rated impact is denial of service, not data theft or privilege escalation. It needs local access and low privileges, so urgency is higher for shared Linux hosts than isolated single-user systems.
Executive priority
Treat as a scheduled but real availability risk. It is not currently evidenced as exploited, but shared Linux infrastructure should receive timely kernel maintenance because the worst documented impact is service disruption.
Technical view
The issue is CWE-190 in sctp_association_init(). If net.sctp.max_autoclose is set as high as UINT_MAX, SCTP autoclose handling can overflow. CVSS 3.1 is 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Kernel stable commits and Debian LTS advisories are cited as remediation references.
Likely exposure
Exposure is likely on Linux systems running affected kernels where SCTP is available and local users can influence relevant SCTP behavior. Prioritize multi-user servers, container hosts, and systems using SCTP. The provided sources do not identify remote-only exposure.
Exploitation context
No KEV listing or cited source in the bundle reports active exploitation. The CVSS vector indicates local, low-complexity exploitation requiring low privileges and no user interaction, with availability impact only.
Researcher notes
The affected-version data in the bundle is not fully self-explanatory and includes commit identifiers plus version entries. Validate against upstream stable commits and distribution package advisories before declaring a host vulnerable or fixed.
Mitigation direction
- Apply kernel updates containing the referenced stable fixes.
- Use distribution advisories, including Debian LTS notices, to map patched package versions.
- Review whether SCTP is required on exposed or shared Linux systems.
- Check vendor guidance before changing sysctl or kernel-module policy.
- Prioritize updates on multi-user and container-host Linux systems.
Validation and detection
- Inventory Linux kernel versions across servers and images.
- Compare installed kernels with vendor advisories and fixed stable commits.
- Check whether SCTP is enabled or required in the environment.
- Review net.sctp.max_autoclose configuration for unusual high values.
- Confirm patched kernels are running after reboot or live patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57938 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/94b7ed0a4896420988e1776942f0a3f67167873eCVE reference, Linux
- https://git.kernel.org/stable/c/081bdb3a31674339313c6d702af922bc29de2c53CVE reference, Linux
- https://git.kernel.org/stable/c/f9c3adb083d3278f065a83c3f667f1246c74c31fCVE reference, Linux
- https://git.kernel.org/stable/c/7af63ef5fe4d480064eb22583b24ffc8b408183aCVE reference, Linux
- https://git.kernel.org/stable/c/271f031f4c31c07e2a85a1ba2b4c8e734909a477CVE reference, Linux
- https://git.kernel.org/stable/c/2297890b778b0e7c8200d6818154f7e461d78e94CVE reference, Linux
- https://git.kernel.org/stable/c/4e86729d1ff329815a6e8a920cb554a1d4cb5b8dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.