CVE-2024-47678
A flaw in the Linux kernel’s ICMP rate‑limiting logic could let an attacker send large numbers of ICMP packets to a host. The bug was fixed by reordering the rate‑limit checks so that per‑destination limits are applied before the host‑wide limit. The patch also removed an unnecessary lock for better performance.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users, regardless of distribution, are affected until they upgrade to a kernel version that includes the patch.
Real-world impact
An attacker could flood a target with ICMP packets, potentially exhausting resources or causing a denial‑of‑service condition. Because the flaw does not require authentication, anyone on the network could exploit it.
Why this severity
The CVSS score of 9.4 reflects that the vulnerability is exploitable over the network (AV:N), requires no privileges (PR:N), and has no user interaction (UI:N). It can lead to high confidentiality and integrity impact by allowing an attacker to send arbitrary ICMP traffic, while the availability impact is considered low because the host‑wide limit still protects the system from total exhaustion.
What to do about it
- 01Update the Linux kernel to a version that includes the patch that reorders ICMP rate limiting.
- 02Reboot the system to load the new kernel.
NVD description indicates patch applied
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.