CVE-2024-47735

5.5 · MEDIUM

Published Oct 21, 2024 linux CWE-667 EPSS 0.19% (9th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-47735 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled

Fix missuse of spin_lock_irq()/spin_unlock_irq() when

spin_lock_irqsave()/spin_lock_irqrestore() was hold.

This was discovered through the lock debugging, and the corresponding

log is as follows:

raw_local_irq_restore() called with IRQs enabled

WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40

...

Call trace:

warn_bogus_irq_restore+0x30/0x40

_raw_spin_unlock_irqrestore+0x84/0xc8

add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]

hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]

hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]

create_qp+0x138/0x258

ib_create_qp_kernel+0x50/0xe8

create_mad_qp+0xa8/0x128

ib_mad_port_open+0x218/0x448

ib_mad_init_device+0x70/0x1f8

add_client_context+0xfc/0x220

enable_device_and_get+0xd0/0x140

ib_register_device.part.0+0xf4/0x1c8

ib_register_device+0x34/0x5

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 4.9, < 5.10.227	Affected

References

Ref git.kernel.org/stable/c/07f0f643d7e570dbe8ef6f5c3367a43e3086a335 Ref git.kernel.org/stable/c/094a1821903f33fb91de4b71087773ee16aeb3a0 Ref git.kernel.org/stable/c/2656336a84fcb6802f6e6c233f4661891deea24f Ref git.kernel.org/stable/c/29c0f546d3fd66238b42cf25bcd5f193bb1cf794 Ref git.kernel.org/stable/c/425589d4af09c49574bd71ac31f811362a5126c3 Ref git.kernel.org/stable/c/74d315b5af180220d561684d15897730135733a6 Ref git.kernel.org/stable/c/a1a3403bb1826c8ec787f0d60c3e7b54f419129e Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html Ref cert-portal.siemens.com/productcert/html/ssa-265688.html

Frequently Asked Questions

What is CVE-2024-47735?

CVE-2024-47735 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-47735?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-47735?

How can CyberStrike help with CVE-2024-47735?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-47735 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719