Details of VAR-202406-0959

ID

VAR-202406-0959

CVE

CVE-2024-38662

TITLE

Linux of Linux Kernel Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2024-003763

DESCRIPTION

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash. We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types. Linux of Linux Kernel Exists in unspecified vulnerabilities.Information may be tampered with. The RUGGEDCOM RST2428P is a Layer 2 Ethernet switch based on the SINEC operating system with up to 28 non-blocking interfaces. SCALANCE X switches are used to connect industrial components such as programmable logic controllers (PLCs) or human-machine interfaces (HMIs). Multiple vulnerabilities in third-party components of Siemens' SINEC OS could allow attackers to gain control of the server

Trust: 2.16

sources: NVD: CVE-2024-38662 // JVNDB: JVNDB-2024-003763 // CNVD: CNVD-2025-19346

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-19346

AFFECTED PRODUCTS

vendor:	linux	model:	kernel	scope:	eq	version:	6.10.0	Trust: 1.8
vendor:	linux	model:	kernel	scope:	lt	version:	5.10.219	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	6.9	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.1.93	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.9.4	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	6.6	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	5.10	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	6.1	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	6.6.33	Trust: 1.0
vendor:	linux	model:	kernel	scope:	gte	version:	5.15	Trust: 1.0
vendor:	linux	model:	kernel	scope:	lt	version:	5.15.161	Trust: 1.0
vendor:	linux	model:	kernel	scope:	eq	version:	6.1 that's all 6.1.93	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	5.10 that's all 5.10.219	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	6.9 that's all 6.9.4	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	5.15 that's all 5.15.161	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	-	Trust: 0.8
vendor:	linux	model:	kernel	scope:	eq	version:	6.6 that's all 6.6.33	Trust: 0.8
vendor:	siemens	model:	ruggedcom rst2428p	scope:	lt	version:	v3.1	Trust: 0.6
vendor:	siemens	model:	scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family	scope:	lt	version:	v3.1	Trust: 0.6
vendor:	siemens	model:	scalance xcm-/xrm-/xch-/xrh-300 family	scope:	lt	version:	v3.1	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // JVNDB: JVNDB-2024-003763 // NVD: CVE-2024-38662

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2024-38662
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2024-38662
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2025-19346
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-19346
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2024-38662
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.0
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2024-38662
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-19346 // JVNDB: JVNDB-2024-003763 // NVD: CVE-2024-38662

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-003763 // NVD: CVE-2024-38662

PATCH

title:	Linux Kernel Archives	url:	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1	Trust: 0.8
title:	Patch for Multiple vulnerabilities in Siemens SINEC OS third-party components	url:	https://www.cnvd.org.cn/patchInfo/show/723071	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // JVNDB: JVNDB-2024-003763

EXTERNAL IDS

db:	NVD	id:	CVE-2024-38662	Trust: 2.6
db:	SIEMENS	id:	SSA-613116	Trust: 1.6
db:	SIEMENS	id:	SSA-265688	Trust: 1.0
db:	JVNDB	id:	JVNDB-2024-003763	Trust: 0.8
db:	CNVD	id:	CNVD-2025-19346	Trust: 0.6

sources: CNVD: CNVD-2025-19346 // JVNDB: JVNDB-2024-003763 // NVD: CVE-2024-38662

REFERENCES

url:	https://cert-portal.siemens.com/productcert/html/ssa-613116.html	Trust: 1.6
url:	https://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d	Trust: 1.0
url:	https://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e	Trust: 1.0
url:	https://cert-portal.siemens.com/productcert/html/ssa-265688.html	Trust: 1.0
url:	https://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9	Trust: 1.0
url:	https://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d	Trust: 1.0
url:	https://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1	Trust: 1.0
url:	https://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-38662	Trust: 0.8

sources: CNVD: CNVD-2025-19346 // JVNDB: JVNDB-2024-003763 // NVD: CVE-2024-38662

SOURCES

db:	CNVD	id:	CNVD-2025-19346
db:	JVNDB	id:	JVNDB-2024-003763
db:	NVD	id:	CVE-2024-38662

LAST UPDATE DATE

2026-06-19T20:40:27.053000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-19346	date:	2025-08-22T00:00:00
db:	JVNDB	id:	JVNDB-2024-003763	date:	2024-06-25T06:18:00
db:	NVD	id:	CVE-2024-38662	date:	2026-05-12T12:16:56.070

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-19346	date:	2025-08-12T00:00:00
db:	JVNDB	id:	JVNDB-2024-003763	date:	2024-06-25T00:00:00
db:	NVD	id:	CVE-2024-38662	date:	2024-06-21T12:15:11.180