CVE-2024-36971
Estado: AnalizadaAlta (7.8)⚠ Explotación activa
In the Linux kernel, the following vulnerability has been resolved:
net: fix __dst_negative_advice() race
__dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves.
Leer descripción completaMostrar menos
Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.70%
- Percentil entre todas las CVEs puntuadas: 85
- Fecha de la puntuación: 1/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 7/8/2024
- Plazo de remediación: 28/8/2024
- Uso conocido en ransomware: Unknown
Tecnologías afectadas (2)
CWE
- CWE-416
- CWE-416
Referencias
- https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
- https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
- https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
- https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
- https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
- https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
- https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
- https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf
- https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
- https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
- https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
- https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
- https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
- https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
- https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
- https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-36971",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-36971",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-08-08T03:55:25.565547Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "051c0bde9f0450a2ec3d62a86d2a0d2fad117f13",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "db0082825037794c5dba9959c9de13ca34cc5e72",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "2295a7ef5c8c49241bff769e7826ef2582e532a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "eacb8b195579c174a6d3e12a9690b206eb7f28cf",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "81dd3c82a456b0015461754be7cb2693991421b4",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "5af198c387128a9d2ddd620b0f0803564a4d4508",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "b8af8e6118a6605f0e495a58d591ca94a85a50fc",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314",
"lessThan": "92f1655aa2b2294d0b49925f3b875a634bd3b59e",
"versionType": "git"
}
],
"programFiles": [
"include/net/dst_ops.h",
"include/net/sock.h",
"net/ipv4/route.c",
"net/ipv6/route.c",
"net/xfrm/xfrm_policy.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.316",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.278",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.219",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.161",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.94",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.34",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.9.4",
"versionType": "semver",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/dst_ops.h",
"include/net/sock.h",
"net/ipv4/route.c",
"net/ipv6/route.c",
"net/xfrm/xfrm_policy.c"
],
"defaultStatus": "affected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:4.6:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "4.6"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "051c0bde9f04",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "db0082825037",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "2295a7ef5c8c",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "eacb8b195579",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "81dd3c82a456",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "5af198c38712",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "b8af8e6118a6",
"versionType": "git"
},
{
"status": "affected",
"version": "a87cb3e48ee8",
"lessThan": "92f1655aa2b2",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "0",
"lessThan": "4.6",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:4.19.316:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "4.19.316",
"lessThan": "4.20",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.4.278:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "5.4.278",
"lessThan": "5.5",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.10.219:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "5.10.219",
"lessThan": "5.11",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:5.15.161:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "5.15.161",
"lessThan": "5.16",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:6.1.94:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.1.94",
"lessThan": "6.2",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:6.6.34:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.6.34",
"lessThan": "6.7",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:6.9.4:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.9.4",
"lessThan": "6.10",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:6.10:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.10",
"versionType": "custom",
"lessThanOrEqual": "*"
}
],
"defaultStatus": "affected"
}
]
}
],
"published": "2024-06-10T09:15:09.127",
"references": [
{
"url": "https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk->dst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk->sk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three ->negative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: fix __dst_negative_advice() race __dst_negative_advice() no aplica las reglas adecuadas de RCU cuando se debe borrar sk->dst_cache, lo que genera una posible UAF. Las reglas de RCU son que primero debemos borrar sk->sk_dst_cache y luego llamar a dst_release(old_dst). Tenga en cuenta que sk_dst_reset(sk) implementa este protocolo correctamente, mientras que __dst_negative_advice() utiliza el orden incorrecto. Dado que ip6_negative_advice() tiene una lógica especial contra RTF_CACHE, esto significa que cada uno de los tres ->negative_advice() métodos existentes debe realizar sk_dst_reset() ellos mismos. Tenga en cuenta que la verificación de NULL dst está centralizada en __dst_negative_advice(), no es necesario duplicarla en varias devoluciones de llamada. Muchas gracias a Clement Lecigne por dar seguimiento a este problema. Este antiguo error se hizo visible después de la confirmación culpada, utilizando sockets UDP."
}
],
"lastModified": "2026-06-17T07:37:30.630",
"cisaActionDue": "2024-08-28",
"cisaExploitAdd": "2024-08-07",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A293D74-EB53-4BBF-86BD-0569A72A4192",
"versionEndExcluding": "4.19.316",
"versionStartIncluding": "4.6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7FDBF235-DA18-49A1-8690-6C7272FD0701",
"versionEndExcluding": "5.4.278",
"versionStartIncluding": "4.20"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9063AF3-D593-43B7-810D-58B87F82F9F9",
"versionEndExcluding": "5.10.219",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31130639-53FE-4726-8986-434EE2528CB2",
"versionEndExcluding": "5.15.161",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D20DE32-76F8-4E4C-A8DF-5B53082D18E5",
"versionEndExcluding": "6.1.94",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BD9DCFD-0342-4039-B8CE-70F26DB7173B",
"versionEndExcluding": "6.6.34",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "991B9791-966A-4D18-9E8D-A8AB128E5627",
"versionEndExcluding": "6.9.4",
"versionStartIncluding": "6.7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Android Kernel Remote Code Execution Vulnerability"
}