Junglewise Threat Intelligence

CVE-2024-36008: Linux Kernel NULL pointer dereference in ip_route_use_hint

CVE-2024-36008 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system processes certain IPv4 network traffic hints without properly verifying internal data structures. This results in a system crash (NULL pointer dereference), which can disrupt operations and lead to a denial-of-service condition.

Technical details

A NULL pointer dereference vulnerability exists in the Linux kernel's IPv4 stack within the ip_route_use_hint() function. The root cause is a failure to check the return value of __in_dev_get_rcu(), which can return NULL, before it is passed to fib_validate_source(). An attacker with local access can trigger this condition, leading to a kernel panic and denial of service. The vulnerability was identified by syzbot and affects multiple stable kernel branches. Patches have been released for affected versions including 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.8.y.

Affected products

  • Linux Linux Kernel 5.5 to 5.10.216, 5.11 to 5.15.158, 5.16 to 6.1.90, 6.2 to 6.6.28, 6.7 to 6.8.7

Timeline

  • 2024-04-21: patched: Initial patch authored by Eric Dumazet
  • 2024-05-20: advisory: CVE-2024-36008 published in NVD

References

Related threats