Junglewise Threat Intelligence

CVE-2024-36489: Linux Kernel NULL pointer dereference in tls_init

CVE-2024-36489 · Severity: medium · CVSS 5.5 · Published 2024-06-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Transport Layer Security (TLS) implementation could allow a local attacker to crash the system. The issue is caused by a synchronization error during the initialization of secure network connections. While it does not allow for data theft, it can lead to a denial-of-service condition, impacting system availability and operations.

Technical details

A race condition exists in the Linux kernel's TLS implementation due to a missing write memory barrier in tls_init(). Specifically, in tls_ctx_create(), store-store reordering can occur between the initialization of ctx->sk_proto and the update of sk->sk_prot. If these operations are reordered, a concurrent call to tls_setsockopt or tls_getsockopt on another CPU may observe a NULL value for the protocol structure, resulting in a NULL pointer dereference. The fix involves moving the rcu_assign_pointer() call to after the context initialization to utilize its inherent release barrier semantics. This is a local attack vector requiring no special privileges beyond the ability to initiate TLS socket operations.

Affected products

  • Linux Linux Kernel 5.7 to 5.10.218, 5.11 to 5.15.160, 5.16 to 6.1.92, 6.2 to 6.6.32, 6.7 to 6.9.3

Timeline

  • 2024-06-21: disclosed
  • 2024-06-21: advisory
  • 2024-05-23: patched: Initial patch in mainline kernel

References

Related threats