CyberSecBulletin
CVE-2024-36972NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2024-36972 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1, 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1, d59ae9314b97e01c76a4171472441e55721ba636 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.52% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 or 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1 or d59ae9314b97e01c76a4171472441e55721ba636 or 4708f49add84a57ce0ccc7bf9a6269845c631cc3, whichever matches your release line, or a later version.
  2. Update linux_kernel to 518a994aa0b8 or 4bf6964451c3 or d59ae9314b97 or 4708f49add84, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux4fe505c63aa3273135a57597fda761e9aecc7668 up to, but not including, 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1; e0e09186d8821ad59806115d347ea32efa43ca4b up to, but not including, 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1; b74aa9ce13d02b7fd37c5325b99854f91b9b4276 up to, but not including, d59ae9314b97e01c76a4171472441e55721ba636; 1279f9d9dec2d7462823a18c29ad61359e0a007d up to, but not including, 4708f49add84a57ce0ccc7bf9a6269845c631cc3; 1279f9d9dec2d7462823a18c29ad61359e0a007d up to, but not including, 9841991a446c87f90f66f4b9fee6fe934c1336a2; 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140; 5.15.149 up to, but not including, 5.15.161; 6.1.78 up to, but not including, 6.1.93; and 3 more ranges518a994aa0b87d96f1bc6678a7035df5d1fcd7a1, 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1, d59ae9314b97e01c76a4171472441e55721ba636, 4708f49add84a57ce0ccc7bf9a6269845c631cc3, 9841991a446c87f90f66f4b9fee6fe934c1336a2, 5.15.161
Linuxlinux_kernel4fe505c63aa3 up to, but not including, 518a994aa0b8; e0e09186d882 up to, but not including, 4bf6964451c3; b74aa9ce13d0 up to, but not including, d59ae9314b97; 1279f9d9dec2 up to, but not including, 4708f49add84; 1279f9d9dec2 up to, but not including, 9841991a446c; 6.8518a994aa0b8, 4bf6964451c3, d59ae9314b97, 4708f49add84, 9841991a446c

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.5HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set NULL to it locklessly. However, the peer socket still can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading NULL pointer dereference. [0] To fix the issue, let's update unix_sk(sk)->oob_skb under the sk_receive_queue's lock and take it everywhere we touch oob_skb. Note that we defer kfree_skb() in manage_oob() to silence lockdep false-positive (See [1]). [0]: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events delayed_fput RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847) Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00 R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> unix_release_sock (net/unix/af_unix.c:654) unix_release (net/unix/af_unix.c:1050) __sock_release (net/socket.c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) delayed_fput (fs/file_table.c:444 (discriminator 3)) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:257) </TASK> Modules linked in: CR2: 0000000000000008

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.