CVE-2024-36971

Android Kernel Remote Code Execution Vulnerability

Debian Linux

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special…

10. Jun 2024

Ausgewertete Quellen

• Debian
  https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971
• CISA
  Android Kernel Remote Code Execution Vulnerability
• NVD
  CVE-2024-36971