CVE-2024-35902 – This CVE addresses a NULL pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2024-35902?

CVE-2024-35902 has a CVSS score of 5.5 (MEDIUM). This CVE addresses a NULL pointer dereference vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. When cp (connection pointer) is NULL, accessing cp->cp_conn causes a kernel panic or system crash. Systems running vulnerable Linux kernel versions with RDS enabled are affected.

📋 TL;DR

This CVE addresses a NULL pointer dereference vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. When cp (connection pointer) is NULL, accessing cp->cp_conn causes a kernel panic or system crash. Systems running vulnerable Linux kernel versions with RDS enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not explicitly stated in CVE, but patches are available in stable kernel trees. Likely affects multiple kernel versions before the fix commits.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires RDS subsystem to be enabled and used. Not all Linux systems have RDS enabled by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash or kernel panic when specific RDS operations are performed with NULL connection pointers.

🟢

If Mitigated

Minor service interruption if system automatically recovers from crash, but still causes availability impact.

🌐 Internet-Facing: LOW - RDS is typically used in internal or cluster environments, not commonly exposed to internet.

🏢 Internal Only: MEDIUM - Systems using RDS for internal communication or clustering could experience crashes affecting dependent services.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger specific RDS operations with NULL connection pointers, typically requiring local access or specific application conditions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions containing commits: 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b, 6794090c742008c53b344b35b021d4a3093dc50a, 92309bed3c5fbe2ccd4c45056efd42edbd06162d, bcd46782e2ec3825d10c1552fcb674d491cc09f9, cbaac2e5488ed54833897264a5ffb2a341a9f196

Vendor Advisory: https://git.kernel.org/stable/c/62fc3357e079a07a22465b9b6ef71bb6ea75ee4b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution vendor for specific patched kernel packages. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable RDS module

linux

If RDS functionality is not required, disable the RDS kernel module to prevent exploitation.

echo 'install rds /bin/false' >> /etc/modprobe.d/disable-rds.conf
rmmod rds

🧯 If You Can't Patch

Disable RDS functionality if not required
Restrict access to systems using RDS and monitor for crash events

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if RDS module is loaded: lsmod | grep rds

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version contains one of the fix commits or check with distribution vendor for patched kernel version.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
System crash logs
RDS-related error messages

Network Indicators:

Unexpected RDS connection failures
Cluster communication disruptions

SIEM Query:

Search for kernel panic events or system crash reports on systems with RDS enabled

📊 Metadata

CVE ID: CVE-2024-35902

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 19, 2024

Last Updated: December 30, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35902, you might also want to check these: