CVE-2024-36489

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36489
In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b Patch
https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b Patch
https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302 Patch
https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c Patch
https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071 Patch
https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

09 Sep 2024, 13:32

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tls: corrige la barrera de memoria faltante en tls_init En tls_init(), falta una barrera de memoria de escritura y el reordenamiento tienda-tienda puede causar una desreferencia NULL en tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // En tls_init() // En tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // En update_sk_prot( ) WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // En sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // En tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt () -(3) En el escenario anterior, cuando (1) y (2) se reordenan, (3) puede observar el valor NULL de ctx->sk_proto, lo que provoca la desreferencia NULL. Para solucionarlo, confiamos en rcu_assign_pointer() que implica la semántica de barrera de liberación. Al mover rcu_assign_pointer() después de inicializar ctx->sk_proto, podemos asegurarnos de que ctx->sk_proto sean visibles al cambiar sk->sk_prot.
References () https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b - () https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b - Patch
References () https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b - () https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b - Patch
References () https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302 - () https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302 - Patch
References () https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c - () https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c - Patch
References () https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071 - () https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071 - Patch
References () https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b - () https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b - Patch

21 Jun 2024, 11:22

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-21 11:15

Updated : 2024-09-09 13:32

NVD link : CVE-2024-36489

Mitre link : CVE-2024-36489

CVE.ORG link : CVE-2024-36489

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference