Android Kernel Remote Code Execution
CVE-2024-36971 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13, db0082825037794c5dba9959c9de13ca34cc5e72, 2295a7ef5c8c49241bff769e7826ef2582e532a6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on August 7, 2024, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Linux to 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 or db0082825037794c5dba9959c9de13ca34cc5e72 or 2295a7ef5c8c49241bff769e7826ef2582e532a6 or eacb8b195579c174a6d3e12a9690b206eb7f28cf, whichever matches your release line, or a later version.
- Update linux_kernel to 051c0bde9f04 or db0082825037 or 2295a7ef5c8c or eacb8b195579, whichever matches your release line, or a later version.
- CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, db0082825037794c5dba9959c9de13ca34cc5e72; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, 2295a7ef5c8c49241bff769e7826ef2582e532a6; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, eacb8b195579c174a6d3e12a9690b206eb7f28cf; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, 81dd3c82a456b0015461754be7cb2693991421b4; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, 5af198c387128a9d2ddd620b0f0803564a4d4508; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, b8af8e6118a6605f0e495a58d591ca94a85a50fc; a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 up to, but not including, 92f1655aa2b2294d0b49925f3b875a634bd3b59e; and 1 more ranges | 051c0bde9f0450a2ec3d62a86d2a0d2fad117f13, db0082825037794c5dba9959c9de13ca34cc5e72, 2295a7ef5c8c49241bff769e7826ef2582e532a6, eacb8b195579c174a6d3e12a9690b206eb7f28cf, 81dd3c82a456b0015461754be7cb2693991421b4, 5af198c387128a9d2ddd620b0f0803564a4d4508 |
| Linux | linux_kernel | 4.6; a87cb3e48ee8 up to, but not including, 051c0bde9f04; a87cb3e48ee8 up to, but not including, db0082825037; a87cb3e48ee8 up to, but not including, 2295a7ef5c8c; a87cb3e48ee8 up to, but not including, eacb8b195579; a87cb3e48ee8 up to, but not including, 81dd3c82a456; a87cb3e48ee8 up to, but not including, 5af198c38712; a87cb3e48ee8 up to, but not including, b8af8e6118a6; and 1 more ranges | 051c0bde9f04, db0082825037, 2295a7ef5c8c, eacb8b195579, 81dd3c82a456, 5af198c38712 |
| Debian | Debian Linux | 10.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | NVD |
| CVSS 3.1 | 7.8 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
- git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
- git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
- git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
- git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
- git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
- git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
- git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971US Government Resource
Other references
Recent Use After Free vulnerabilities
- 8.4 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
- 7.8 High severity
- 7.5 High severity
Spotted an error? Tell us.