medium 5.5

CVE-2024-47684 json

tcp: check skb is non-NULL in tcp_rto_delta_us()

published 2024-10-21 2 y ago modified 2026-10-15 25 d ago also EUVD-2024-42604

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases:

Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_even ---truncated---

Patch / fix

fixed in 8 distros 5 links 9

Linux Linux 3.11, 4.19.323, 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1.1
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens RUGGEDCOM RST2428P V3.2
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family V3.2
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family V3.2

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.115-1
linux Debian 14, Debian 13 6.11.2-1

debian advisories DEBIAN-CVE-2024-47684

linux Ubuntu 20.04 LTS 5.4.0-208.228
linux Ubuntu 22.04 LTS 5.15.0-127.137
linux Ubuntu 24.04 LTS 6.8.0-54.56
linux-aws Ubuntu 20.04 LTS 5.4.0-1140.150
linux-aws Ubuntu 22.04 LTS 5.15.0-1073.79
linux-aws Ubuntu 24.04 LTS 6.8.0-1023.25
linux-gcp Ubuntu 20.04 LTS 5.4.0-1143.152
linux-gcp Ubuntu 22.04 LTS 5.15.0-1072.80

ubuntu advisories UBUNTU-CVE-2024-47684

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-livepatch-MICRO-6-0-RT_Update_3 Linux Micro 6.0 3-1.2
kernel-livepatch-MICRO-6-0_Update_2 Linux Micro 6.1, Linux Micro 6.0 3-1.1
kernel-livepatch-MICRO-6-0_Update_3 Linux Micro 6.0 3-1.2
kernel-livepatch-MICRO-6-0-RT_Update_2 Linux Micro 6.0 3-1.1
kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1.21.4

suse advisories SUSE-SU-2025:4123-1 SUSE-SU-2025:20191-1 SUSE-SU-2025:20188-1 SUSE-SU-2025:20285-1 SUSE-SU-2025:20189-1 SUSE-SU-2025:20186-1

kernel-source-longterm openSUSE Tumbleweed 6.12.11-1.1
kernel-source openSUSE Tumbleweed 6.11.8-1.1

opensuse advisories openSUSE-SU-2025:14705-1 openSUSE-SU-2024:14500-1

kernel Azure Linux 3.0 6.6.56.1-5
kernel CBL-Mariner 2.0 5.15.173.1-1

azure linux advisories AZL-50659 AZL-50694

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-47684 updated 2026-11-07 cvss 5.5

kernel: tcp: check skb is non-NULL in tcp_rto_delta_us()

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
affected: workaround, no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-102-01 updated 2026-05-14 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-07 updated 2026-02-25 cvss 5.5

Siemens Third-Party Components in SINEC OS

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.2
affected: fixed in V3.2 support.industry.siemens.com
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.2
affected: fixed in V3.2
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.2
affected: fixed in V3.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-348-10 updated 2025-08-12 cvss 5.5

Siemens SIMATIC S7-1500

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-21)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Siemens RUGGEDCOM RST2428P
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-47684
NVD CVE-2024-47684

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected products

Classification

References

Sources