Linux · Linux Kernel · CVE-2024-36883
**Name of the Vulnerable Software and Affected Versions**
Linux kernel (affected versions not specified)
**Description**
The issue is related to an out-of-bounds access in the `net alloc generic()` function in the Linux kernel. This function is called by `net alloc()` without any locking, and it reads `max gen ptrs`, which is changed under `pernet ops rwsem`. The function reads `max gen ptrs` twice, first to allocate an array and then to set `s.len`, which is later used to limit the bounds of the array access. It is possible that the array is allocated and another thread is registering a new pernet ops, increments `max gen ptrs`, which is then used to set `s.len` with a larger than allocated length for the variable array. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information.
**Recommendations**
To resolve the issue, read `max gen ptrs` only once in `net alloc generic()`. If `max gen ptrs` is later incremented, it will be caught in `net assign generic()`. As a temporary workaround, consider restricting access to the vulnerable `net alloc generic()` function until a patch is available.