Security readout for executives and security teams
Plain-English summary
CVE-2024-58071 is a Linux kernel team networking bug. A local user with low privileges can create an invalid team-device relationship that may trigger recursive locking and affect system availability. The sources show no evidence of data theft, privilege escalation, or active exploitation.
Executive priority
Treat this as a moderate availability risk, not a breach indicator. Prioritize patching shared Linux hosts, network appliances, and container platforms where untrusted users or workloads can control network interfaces.
Technical view
The team driver failed to block adding a device that was already a lower device of an existing team port. That invalid hierarchy can cause recursive acquisition of team->team_lock_key during netdevice events, producing a potential deadlock. The CVSS vector is local, low complexity, low privileges, no user interaction, availability high impact only.
Likely exposure
Exposure is limited to Linux systems using vulnerable kernel versions and the team networking driver. Risk is most relevant where local users or workloads can manage network links, virtual interfaces, VLANs, or team devices.
Exploitation context
The CVE record provides a local ip-link reproduction scenario, but KEV is false and the provided sources do not claim active exploitation in the wild. Exploitation requires local access and network-device manipulation capability.
Researcher notes
The issue maps to CWE-667 and CVSS 5.5. The affected range data in the bundle is version-oriented and commit-oriented, so rely on vendor kernel packages for final applicability. No confidentiality or integrity impact is supported by the supplied sources.
Mitigation direction
- Apply the relevant Linux stable kernel update containing the team driver fix.
- Use distribution kernel packages, such as Debian LTS updates where applicable.
- Restrict local ability to create or reconfigure network interfaces.
- Review container or virtualization setups granting network administration capabilities.
- Check vendor advisories for appliance or embedded Linux exposure.
Validation and detection
- Inventory Linux kernel versions against the affected and fixed ranges in vendor guidance.
- Identify systems loading or using the team networking driver.
- Review who can run network interface management operations locally.
- Confirm patched kernels include the referenced stable commits.
- Monitor kernel logs for lockdep warnings or deadlock symptoms.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 0a7794b9
- Linux stable commit 62ff1615
- Linux stable commit bd099a2f
- Linux stable commit adff6ac8
- Linux stable commit 184a564e
- Linux stable commit 1bb06f91
- Linux stable commit d9bce131
- Linux stable commit 3fff5da4
- Debian LTS advisory May 2025
- Debian LTS advisory March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-667: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58071 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0a7794b9ca78c8e7d001c583bf05736169de3f20CVE reference, Linux
- https://git.kernel.org/stable/c/62ff1615815d565448c37cb8a7a2a076492ec471CVE reference, Linux
- https://git.kernel.org/stable/c/bd099a2fa9be983ba0e90a57a59484fe9d520ba8CVE reference, Linux
- https://git.kernel.org/stable/c/adff6ac889e16d97abd1e4543f533221127e978aCVE reference, Linux
- https://git.kernel.org/stable/c/184a564e6000b41582f160a5be9a9b5aabe22ac1CVE reference, Linux
- https://git.kernel.org/stable/c/1bb06f919fa5bec77ad9b6002525c3dcc5c1fd6cCVE reference, Linux
- https://git.kernel.org/stable/c/d9bce1310c0e2a55888e3e08c9f69d8377b3a377CVE reference, Linux
- https://git.kernel.org/stable/c/3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Locking
Improper Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.