CVE-2024-36489

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store

reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0 CPU1

----- -----

// In tls_init()

// In tls_ctx_create()

ctx = kzalloc()

ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot()

WRITE_ONCE(sk->sk_prot, tls_prots) -(2)

// In sock_common_setsockopt()

READ_ONCE(sk->sk_prot)->setsockopt()

// In tls_{setsockopt,getsockopt}()

ctx->sk_proto->setsockopt() -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe

the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release

barrier semantic.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References