CVE-2024-57982

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The race is reliably driven locally: XFRM netlink (`XFRM_MSG_NEWSA` to force `xfrm_hash_resize()`, `XFRM_MSG_GETSA` to drive concurrent lookups) is reachable from an unprivileged user's own network namespace, where the xfrm state hash tables are per-netns. Although the lookup is also hit by unauthenticated remote ESP/AH packets via `xfrm_input_state_lookup()`, a remote attacker cannot schedule the racing resize, so the local vector is the exploitable one.

AC:LAttack complexity, low

The attacker controls both sides of the race — inserting SAs to schedule `xfrm_hash_resize()` on one CPU while issuing lookups with attacker-chosen spi/daddr on another — and can repeat indefinitely by creating fresh network namespaces, each yielding a new sequence of doubling resizes. syzbot reproduced this from ordinary syscalls.

PR:LPrivileges required, low

`xfrm_user_rcv_msg()` requires `netlink_net_capable(CAP_NET_ADMIN)`, which resolves to `ns_capable(net->user_ns, CAP_NET_ADMIN)` and is therefore satisfied by any unprivileged user after `unshare -Urn`. No real root in the initial namespace is needed.

UI:NUser interaction, none

The attacker triggers both the hash resize and the concurrent state lookup entirely from their own threads; no victim action or cooperation is involved.

S:UScope, unchanged

The out-of-bounds access and any resulting corruption stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The stale-table/new-mask mismatch reads up to a full table length past the allocation, and the OOB slot is dereferenced as an `hlist_node` and `container_of()`'d into a `struct xfrm_state`, so adjacent slab contents the attacker can groom become a fake-object pointer, yielding reads at attacker-influenced kernel addresses rather than a bounded few-byte leak.

I:HIntegrity impact, high

The bogus state pointer reaches `refcount_inc_not_zero(&x->refcnt)`, an increment write at an attacker-influenced address, and a fabricated `xfrm_state` returned to `xfrm_input()`/`xfrm_state_find()` is then used for IPsec processing — both usable to corrupt kernel state and pursue control-flow hijack.

A:HAvailability impact, high

Walking a garbage hlist pointer read past the end of the hash table dereferences a wild address, producing an oops or panic; with larger page-order tables the OOB read can also fault into unmapped memory.