PT-2024-5775 · Linux+6 · Linux Kernel+6
Syzbot
·
Published
2024-04-23
·
Updated
2025-09-29
·
CVE-2024-36008
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The vulnerability is related to a NULL pointer dereference in the
fib validate source() function in the Linux kernel's IPv4 component. This issue can be triggered by syzbot in an old tree and appears to exist in the latest trees as well. The vulnerability can cause a general protection fault, likely due to a non-canonical address. All calls to in dev get rcu() must be checked for a NULL result to prevent this issue.Recommendations
To resolve this issue, update the Linux kernel to version 6.6.37 or later. Ensure that all calls to
in dev get rcu() are checked for a NULL result to prevent NULL pointer dereferences. As a temporary workaround, consider disabling the fib validate source() function until a patch is available. However, this may have unintended consequences on network functionality and should be used with caution.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu