External risk intelligence

Linux Kernel netfilter IPv6 TCP Header Handling Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-47685

This vulnerability resides within the Linux kernel's netfilter subsystem, which processes network traffic at the edge of the operating system. Because it affects core packet handling and protocol rejection logic, it is exposed to incoming network traffic by design in any environment where the kernel processes standard IPv6 network communications, making it inherently public-facing.

Debian Linux

11.03.18 to before 4.19.3234.20 to before 5.4.2855.5 to before 5.10.2275.11 to before 5.15.1685.16 to before 6.1.1136.2 to before 6.6.546.7 to before 6.10.136.11 to before 6.11.2

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's network filtering component that could allow for the transmission of malformed data when handling IPv6 traffic. This issue is related to the proper handling of reserved bits within the TCP header during the rejection of IPv6 packets.

Inaccurate data sent in network traffic.
Affects core packet handling, accessible externally.
Confirm relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted network packets targeting the Linux kernel's IPv6 netfilter component. If these packets are processed by the `nf_reject_ipv6` function, it could lead to uninitialized data being sent on the network.

Attacker sends malicious network packets.
Kernel's netfilter processes IPv6 traffic.
Leads to uninitialized data transmission.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could lead to unexpected network behavior when the Linux kernel handles IPv6 traffic rejection. Specifically, the `nf_reject_ip6_tcphdr_put` function may send malformed TCP header information on reserved bits, potentially impacting network communication integrity and service availability.

Network packet integrity at risk.
Malformed TCP header data sent.
Unpredictable network service behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's netfilter component, specifically within `nf_reject_ipv6`, impacts network packet handling and requires immediate attention from infrastructure and platform teams. The first step is to identify all systems running the affected kernel versions, determine their network exposure and criticality, and then pinpoint the accountable owner for remediation planning.

Infrastructure and platform teams own the issue.
Verify network exposure and system criticality.
Plan and coordinate kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2024-47685?

This vulnerability affects the Linux kernel, specifically the netfilter subsystem. Netfilter is a powerful framework built into the kernel that manages network traffic, such as filtering, routing, and address translation. This specific issue resides in the nf_reject_ipv6 component, which handles the rejection of incoming IPv6 packets by generating appropriate TCP reset responses.

What is the vulnerability class for this issue?

This issue is classified under CWE-908, which refers to the use of uninitialized resources. In the context of CVE-2024-47685, the kernel was failing to properly clear memory when constructing a TCP header for rejected IPv6 packets. This caused the system to inadvertently include stale, uninitialized data—sometimes called "garbage" data—within the reserved bits of the TCP header transmitted over the network.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending specially crafted network traffic that forces the Linux kernel to reject an IPv6 connection. Because the bug is located in the packet rejection logic itself, it does not require a complex exploit; the vulnerability is triggered automatically whenever the affected kernel code path is executed during standard network packet processing. It cannot be triggered if the system is not processing IPv6 traffic.

Why is this considered an external threat?

Halo Surface Signal identifies this as an external threat because the vulnerable netfilter code processes traffic directly from the network. Since this component handles core IPv6 communications at the edge of the operating system, it is exposed to internet-facing traffic by design. Any system running an affected kernel that accepts IPv6 connections is inherently exposed to this interaction.

What are the first steps to address CVE-2024-47685?

You should begin by auditing your infrastructure to identify all systems running the affected Linux kernel versions listed in the advisory. Once identified, prioritize these systems based on their role and network exposure. Since this is a kernel-level issue, remediation involves coordinating with your platform teams to plan and apply the necessary kernel updates provided by your distribution maintainer.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.