Linux: Use of a Key Past its Expiration Date
CVE-2024-36031 is a critical-severity use of a key past its expiration date vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions ad2011ea787928b2accb5134f1e423b11fe80a8a, ed79b93f725cd0da39a265dc23d77add1527b9be, e4519a016650e952ad9eb27937f8c447d5a4e06d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.75% chance of exploitation within 30 days, higher than 55% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Linux to ad2011ea787928b2accb5134f1e423b11fe80a8a or ed79b93f725cd0da39a265dc23d77add1527b9be or e4519a016650e952ad9eb27937f8c447d5a4e06d or 25777f3f4e1f371d16a594925f31e37ce07b6ec7, whichever matches your release line, or a later version.
- Update linux_kernel to ad2011ea7879 or ed79b93f725c or e4519a016650 or 25777f3f4e1f, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 97be1e865e70e5a0ad0a5b5f5dca5031ca0b53ac up to, but not including, ad2011ea787928b2accb5134f1e423b11fe80a8a; 2552b32b0b349df160a509fe49f5f308cb922f2b up to, but not including, ed79b93f725cd0da39a265dc23d77add1527b9be; 791d5409cdb974c31a1bc7a903ea729ddc7d83df up to, but not including, e4519a016650e952ad9eb27937f8c447d5a4e06d; afc360e8a1256acb7579a6f5b6f2c30b85b39301 up to, but not including, 25777f3f4e1f371d16a594925f31e37ce07b6ec7; 39299bdd2546688d92ed9db4948f6219ca1b9542 up to, but not including, 939a08bcd4334bad4b201e60bd0ae1f278d71d41; 39299bdd2546688d92ed9db4948f6219ca1b9542 up to, but not including, cc219cb8afbc40ec100c0de941047bb29373126a; 39299bdd2546688d92ed9db4948f6219ca1b9542 up to, but not including, 9da27fb65a14c18efd4473e2e82b76b53ba60252; 5.10.206 up to, but not including, 5.10.217; and 4 more ranges | ad2011ea787928b2accb5134f1e423b11fe80a8a, ed79b93f725cd0da39a265dc23d77add1527b9be, e4519a016650e952ad9eb27937f8c447d5a4e06d, 25777f3f4e1f371d16a594925f31e37ce07b6ec7, 939a08bcd4334bad4b201e60bd0ae1f278d71d41, cc219cb8afbc40ec100c0de941047bb29373126a |
| Linux | linux_kernel | 97be1e865e70 up to, but not including, ad2011ea7879; 2552b32b0b34 up to, but not including, ed79b93f725c; 791d5409cdb9 up to, but not including, e4519a016650; afc360e8a125 up to, but not including, 25777f3f4e1f; 39299bdd2546 up to, but not including, 939a08bcd433; 39299bdd2546 up to, but not including, cc219cb8afbc; 39299bdd2546 up to, but not including, 9da27fb65a14; 6.7 | ad2011ea7879, ed79b93f725c, e4519a016650, 25777f3f4e1f, 939a08bcd433, cc219cb8afbc |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of a Key Past its Expiration Date
The product uses a cryptographic key past its expiration date.
How developers prevent this class of flaw
- Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
- Replace keys within a period of time proportional to their strength.
More Use of a Key Past its Expiration Date vulnerabilities (CWE-324)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7
- git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41
- git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252
- git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8a
- git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126a
- git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06d
- git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9be
Other references
Recent Use of a Key Past its Expiration Date vulnerabilities
- 8.8 High severity
Spotted an error? Tell us.