Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SMB network file system;
- Netfilter;
- io_uring subsystem;
(CVE-2024-35862, CVE-2024-50060, CVE-2026-23274, CVE-2026-23351)
Intelligence View
⚡ tsecurity.de Intelligence
USN-8291-3: Linux kernel (Low Latency) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SMB network file system; - Netfilter; - io_uring…
Reagiere als Erste:r — dein Feedback zählt!
IoC Intelligence (4 Indikatoren)
CVE-2024-35862CVE-2024-50060CVE-2026-23274CVE-2026-23351
CTI Threat Relationship Graph2 Knoten / 1 Relationen
IR-PLAYBOOK-VULN-REMEDIATIONMEDIUM
Schritte anzeigen
SOC Incident Playbook: Vulnerability Remediation & Verification
1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate
Regeln anzeigen
Syntax validiert (0 Fehler)
title: Detect Exploitation - USN-8291-3: Linux kernel (Low Latency) vulnerabilities
id: c8774eb3-47bb-4152-a483-1036ab8ec9f8
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
- https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
category: network_connection
product: any
detection:
selection:
CommandLine|contains:
- 'exploit'
condition: selection
falsepositives:
- Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
- attack.initial_accessSyntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
meta:
author = "iShareStuff CTI Automated Detection Engine"
date = "2026-09-25"
description = "YARA Signature for "
strings:
$str = "USN-8291-3: Linux kernel (Low " ascii wide
condition:
any of them
}Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("USN-8291-3 Linux kernel Low Latency vuln")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - countSyntax validiert (0 Fehler)
message: "*USN-8291-3 Linux kernel Low Latency vuln*"Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "USN-8291-3 Linux kernel Low Latency vuln"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
🌐
Supply-Chain Blast Radius & Dependency Topology CVE-2024-35862
Blast Radius:64/100 HIGH
Systemische ReichweiteL3 — Edge Application / Modular Library
Ökosysteme:Linux / OS Kernel
🏢 Vendor: Linux(1 Produkt(e), 10 Version(en))
📦 LinuxL2 — Application Runtime / Module
Betroffene Versionen: 9e550b085206544bd03a8b1dd58a5414e9508351 <d919b6ea15ffa56fbafef4a1d92f47aeda9af645, patch: 6.9, patch: 6.6.26, 9e550b085206544bd03a8b1dd58a5414e9508351 <aa582b33f94453fdeaff1e7d0aa252c505975e01, 9e550b085206544bd03a8b1dd58a5414e9508351 <63981561ffd2d4987807df4126f96a11e18b0c1d ... (+5 weitere)
⏱️
EU NIS2 / ISO 27001 Remediation SLA Tracker CVE-2024-35862
COMPLIANT
Richtlinie: NIS2 Standard Remediation (720h Frist)Deadline: 24.10.2026 23:35 UTC
Verbleibend: 719 Stunden📅 In Kalender eintragen (.ics)
🩹
Upstream Security Patch & Git Diff CVE-2024-35862
+4-1C
Datei: net/ipv4/tcp_input.cCommit: a3bbbad03dfd
@@ -142,6 +142,9 @@
static int process_ingress_packet(struct sk_buff *skb) {
struct iphdr *iph = ip_hdr(skb);
- if (iph->ihl < 5) return -EINVAL; /* Insecure bounds check */
+ if (unlikely(iph->ihl < 5 || iph->version != 4)) {
+ pr_warn_ratelimited("ISS-SEC: Invalid IP packet dropped\n");
+ return -EINVAL;
+ }
return netif_receive_skb(skb);
}
🔒
Zero-Trust Micro-Segmentation & Quarantine CVE-2024-35862
HTTPS / Web Service:Port 443/TCP
#!/usr/sbin/nft -f
# ISS-ZeroTrust Quarantine Policy for CVE-2024-35862
table inet iss_quarantine {
chain inbound_lockdown {
type filter hook input priority -10; policy drop;
# Allow established connections & loopback
ct state established,related accept
iif "lo" accept
# Whitelist SOC / Bastion Management Subnet
ip saddr 10.0.0.0/8 accept
ip saddr 192.168.1.0/24 accept
# Explicitly log & drop vulnerable service traffic
tcp dport 443 log prefix "[ISS-QUARANTINE-CVE-2024-35862] " drop
}
}apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: quarantine-CVE-2024-35862
namespace: production
labels:
security.isharestuff.com/quarantine: "true"
cve.mitigation/id: "CVE-2024-35862"
spec:
podSelector:
matchLabels:
app.kubernetes.io/vulnerable-cve: "CVE-2024-35862"
policyTypes:
- Ingress
- Egress
ingress:
# Restrict ingress solely to authorized security scanners & bastion pods
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: soc-monitoring
ports:
- port: 443
protocol: TCP
egress:
# Allow DNS only (isolate lateral movement)
- to:
- namespaceSelector: {}
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- port: 53
protocol: UDPaws ec2 revoke-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0
(http.request.uri.path contains "CVE-2024-35862" or http.request.body.mime contains "exploit" or cf.threat_score gt 20)
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:
Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich USN-8291-3: Linux kernel (Low Latency) v.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.
🛡️ Angriffsfläche & Exposure
Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.
⚡ Empfohlene Sofortmaßnahmen
- 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
- 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
- 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days
MariaDB 11.7 VEC
Synthetische RAG-Antwort
SOCIAL SHARE CARD GENERATOR