from disclosure to weapon491 days
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Affected2 products (12 components)
Red Hat Enterprise Linux 7 · Red Hat OpenShift Container Platform 4
workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Fixed38 products (1,447 components)
Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat Enterprise Linux BaseOS EUS (v.9.2) · Red Hat Enterprise Linux BaseOS E4S (v.8.6) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v.8.8) · and others 33
Not affected12 products (3,001 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.16 · Red Hat OpenShift Container Platform 4.15 · Red Hat OpenShift Container Platform 4.13 · Red Hat OpenShift Container Platform 4.12 · and others 7
Action required by CISAfederal deadline: 2024-08-28
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
In short
A race condition in the Linux kernel's network code can cause a program to access memory that has already been freed (use-after-free). This happens when the network cache is cleared in the wrong order, potentially crashing the system or allowing attackers to exploit it.
Technical detail
CVE-2024-36971 involves a use-after-free (CWE-416) vulnerability in __dst_negative_advice() where improper RCU synchronization allows sk->dst_cache to be accessed after being released. The vulnerability requires local access and occurs when UDP sockets trigger the flawed cache clearing sequence, where dst_release() is called before sk_dst_cache is cleared, violating RCU ordering semantics.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
In the Linux kernel, the following vulnerability has been resolved:
net: fix __dst_negative_advice() race
__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.
Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Linux
In the same product, most dangerous first.