{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-47739",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-47739"
  ],
  "published": "2024-10-21T12:16:24Z",
  "summary": "padata: use integer wrap around to prevent deadlock on seq_nr overflow",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata->seq_nr and pd->processed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.113",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47739"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/46c4079460f4dcaf445860679558eedef4e1bc91"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/72164d5b648951684b1a593996b37a6083c61d7d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ab205e1c3846326f162180e56825b4ba38ce9c30"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1b8cf11b3ca593a8802a51802cd0c28c38501428"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9e279e6c1f012b82628b89e1b9c65dbefa8ca25a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1bd712de96ad7167fe0d608e706cd60587579f16"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9a22b2812393d93d84358a760c347c21939029a6"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.5,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - The seq_nr counter is driven by ESP packet processing \u2014 `xfrm_input()` reaches `esp_input` \u2192 `crypto_aead_decrypt` \u2192 pcrypt \u2192 `padata_do_parallel` for every inbound ESP packet, and outbound tunnel traffic burns counters on the encrypt shell, so a remote attacker on an IPsec gateway using pcrypt can drive the 32-bit counter to overflow purely with network traffic.\nAC:L - The attacker needs only to sustain packet/request volume until the 32-bit counter wraps \u2014 entirely under their control, with no race window, no memory-layout dependency, and no unknown target state.\nPR:N - The `padata_do_parallel` call happens before ICV/authentication verification in `xfrm_input()`, so forged ESP packets from an unauthenticated attacker consume sequence numbers; outbound-direction counter consumption requires no credentials or SPI knowledge whatsoever.\nUI:N - The counter advances automatically as the kernel processes attacker-supplied traffic; no victim action of any kind is needed.\nS:U - The stalled reorder list and leaked objects are confined to the kernel's own crypto pipeline; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an ordering/comparison error in list insertion \u2014 nothing is read out of bounds and no kernel memory contents are exposed to the attacker.\nI:N - The mis-sort causes `padata_find_next()` to refuse to dequeue rather than to deliver objects out of order, so no data is modified or corrupted and no control-flow primitive is created.\nA:H - The reorder list deadlocks permanently, hanging every subsequent request through that pcrypt algorithm system-wide (the shell is per-instance, shared by all tfms), leaking each queued skb/request and the `parallel_data` forever \u2014 an irrecoverable IPsec/crypto outage plus unbounded memory exhaustion until reboot."
    }
  }
}