Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-47659
CVE-2024-47659:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2024-47659 is a security vulnerability in the Linux kernel's Smack (Simplified Mandatory Access Control Kernel) subsystem, specifically affecting TCP/IPv4 connections. The vulnerability was discovered in October 2024 and affects Linux kernel versions up to 4.19.322, 5.4.284, 5.10.226, 5.15.167, 6.1.109, and 6.6.50. The issue involves incorrect labeling of network packets in TCP/IPv4 connections when using Smack security labels (NVD).
Technical details
The vulnerability stems from how Smack mirrors labels of incoming TCP/IPv4 connections. When a process with label 'foo' connects to a process with label 'bar', all returned IPv4 packets are incorrectly labeled with 'foo' instead of 'bar'. This behavior has been present since Linux kernel version 2.6.29.4. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).
Impact
The vulnerability has two main impacts: 1) Returned packets are incorrectly labeled, leading to potential security policy violations, and 2) A process with label 'bar' can write to a process with label 'foo' without proper authorization. This circumvents Smack's mandatory access control mechanisms and could lead to unauthorized data access or modification (Kernel Patch).
Mitigation and workarounds
The vulnerability has been fixed in multiple Linux kernel versions through patches that correct the packet labeling behavior. The fix involves changing the network packet labeling to use the correct security context. Updated kernel versions are available in various distributions, including Debian 11 (version 6.1.119-1~deb11u1) (Debian Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management