CVE-2024-26597 – A global out-of-bounds read vulnerability in th... (How to Fix)

Q: What is the severity of CVE-2024-26597?

CVE-2024-26597 has a CVSS score of 7.1 (HIGH). A global out-of-bounds read vulnerability in the Linux kernel's RMNET driver allows attackers to read kernel memory beyond allocated bounds when parsing netlink attributes. This affects Linux systems using the Qualcomm RMNET driver for mobile network interfaces. The vulnerability can lead to information disclosure or potentially be leveraged for further exploitation.

📋 TL;DR

A global out-of-bounds read vulnerability in the Linux kernel's RMNET driver allows attackers to read kernel memory beyond allocated bounds when parsing netlink attributes. This affects Linux systems using the Qualcomm RMNET driver for mobile network interfaces. The vulnerability can lead to information disclosure or potentially be leveraged for further exploitation.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions with the vulnerable RMNET driver code, specifically versions before the fix commits listed in references.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with the RMNET driver loaded/compiled (typically Android/Linux mobile devices or systems with Qualcomm networking hardware).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation, system crash, or information leakage of sensitive kernel data structures.

🟠

Likely Case

Information disclosure of kernel memory contents, potentially revealing sensitive data or system state information.

🟢

If Mitigated

Limited impact due to kernel address space layout randomization (KASLR) and other memory protections, though information disclosure still occurs.

🌐 Internet-Facing: LOW - Requires local access or ability to send specific netlink messages to the kernel.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could exploit this to read kernel memory.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires sending crafted netlink messages to the kernel, which typically requires local access or CAP_NET_ADMIN capabilities.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 02467ab8b404d80429107588e0f3425cf5fcd2e5, 093dab655808207f7a9f54cf156240aeafc70590, 17d06a5c44d8fd2e8e61bac295b09153496f87e1, 2295c22348faf795e1ccdf618f6eb7afdb2f7447, 3b5254862258b595662a0ccca6e9eeb88d6e7468

Vendor Advisory: https://git.kernel.org/stable/c/02467ab8b404d80429107588e0f3425cf5fcd2e5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable RMNET driver

linux

Remove or blacklist the RMNET driver if not needed

echo 'blacklist rmnet' >> /etc/modprobe.d/blacklist.conf
rmmod rmnet

Restrict netlink access

linux

Limit which users/processes can send netlink messages

Use Linux capabilities (CAP_NET_ADMIN) restrictions
Implement SELinux/AppArmor policies to restrict netlink socket creation

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from sending netlink messages
Monitor for unusual netlink activity or kernel memory access patterns

🔍 How to Verify

Check if Vulnerable:

Check if RMNET driver is loaded: lsmod | grep rmnet. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Test with KASAN if available to ensure no out-of-bounds reads.

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing KASAN reports for global-out-of-bounds reads
Netlink message parsing errors

Network Indicators:

Unusual netlink socket activity from non-system processes

SIEM Query:

source="kernel" AND ("KASAN" OR "global-out-of-bounds" OR "rmnet")

📊 Metadata

CVE ID: CVE-2024-26597

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: February 23, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26597, you might also want to check these: