cbcvebase.
CVE-2024-36489
published 2024-06-21

CVE-2024-36489: In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
17.0th percentile
In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store
reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0 CPU1
----- -----
// In tls_init()
// In tls_ctx_create()
ctx = kzalloc()
ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot()
WRITE_ONCE(sk->sk_prot, tls_prots) -(2)

// In sock_common_setsockopt()
READ_ONCE(sk->sk_prot)->setsockopt()

// In tls_{setsockopt,getsockopt}()
ctx->sk_proto->setsockopt() -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe
the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release
barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is
initialized, we can ensure that ctx->sk_proto are visible when
changing sk->sk_prot.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.94-1 (bookworm)linux 6.1.94-1 (bookworm)
linuxlinux
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < d72e126e9a36d3d33889829df8fc90100bb0e071d72e126e9a36d3d33889829df8fc90100bb0e071
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < 2c260a24cf1c4d30ea3646124f766ee46169280b2c260a24cf1c4d30ea3646124f766ee46169280b
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < 335c8f1566d8e44c384d16b450a18554896d4e8b335c8f1566d8e44c384d16b450a18554896d4e8b
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < ab67c2fd3d070a21914d0c31319d3858ab4e199cab67c2fd3d070a21914d0c31319d3858ab4e199c
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < ef21007a7b581c7fe64d5a10c320880a033c837bef21007a7b581c7fe64d5a10c320880a033c837b
linuxlinux>= d5bee7374b68de3c44586d46e9e61ffc97a1e886 < 91e61dd7a0af660408e87372d8330ceb218be30291e61dd7a0af660408e87372d8330ceb218be302
linuxlinux_kernel>= 0 < 5.10.221-15.10.221-1
linuxlinux_kernel>= 0 < 6.1.94-16.1.94-1
linuxlinux_kernel>= 0 < 6.9.7-16.9.7-1
linuxlinux_kernel>= 0 < 6.9.7-16.9.7-1
linuxlinux_kernel>= 0 < 5.15.0-121.1315.15.0-121.131
linuxlinux_kernel>= 0 < 6.8.0-44.446.8.0-44.44
linuxlinux_kernel>= 5.11 < 5.15.1615.15.161
linuxlinux_kernel>= 5.16 < 6.1.936.1.93
linuxlinux_kernel>= 5.7 < 5.10.2195.10.219
linuxlinux_kernel>= 6.2 < 6.6.336.6.33
linuxlinux_kernel>= 6.7 < 6.9.46.9.4

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.