CVE-2024-36031 – A Linux kernel vulnerability in the key managem... (How to Fix)

Q: What is the severity of CVE-2024-36031?

CVE-2024-36031 has a CVSS score of 9.8 (CRITICAL). A Linux kernel vulnerability in the key management subsystem unconditionally overwrites key expiration times during instantiation, defaulting them to permanent. This allows attackers to potentially manipulate key expiration to maintain unauthorized access or disrupt DNS resolution updates. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

A Linux kernel vulnerability in the key management subsystem unconditionally overwrites key expiration times during instantiation, defaulting them to permanent. This allows attackers to potentially manipulate key expiration to maintain unauthorized access or disrupt DNS resolution updates. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems using key management subsystem, particularly those relying on DNS resolution with key expiration

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could make temporary authentication keys permanent, maintaining persistent unauthorized access to systems or services that rely on key expiration for security.

🟠

Likely Case

DNS resolution failures due to keys not expiring properly, causing service disruption and potential cache poisoning attacks.

🟢

If Mitigated

Limited to DNS resolution issues without broader system compromise if proper network segmentation and monitoring are in place.

🌐 Internet-Facing: MEDIUM - While the vulnerability affects kernel-level key management, exploitation typically requires some level of system access or specific conditions.

🏢 Internal Only: HIGH - Internal systems using key-based authentication or DNS resolution are directly vulnerable to persistence attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to instantiate keys and understanding of key management subsystem

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes referenced in git commits

Vendor Advisory: https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version 2. Reboot system 3. Verify kernel version matches patched release

🔧 Temporary Workarounds

Monitor key expiration

linux

Implement monitoring for key expiration anomalies and manual key rotation

keyctl show
keyctl timeout <keyid> <seconds>

🧯 If You Can't Patch

Implement strict key rotation policies and monitor for unexpected permanent keys
Restrict key management operations to privileged users only

🔍 How to Verify

Check if Vulnerable:

Check kernel version against patched releases and test key expiration behavior

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and test that key expiration times are preserved during instantiation

📡 Detection & Monitoring

Log Indicators:

Unexpected key creation/modification events
DNS resolution failures
Key expiration time anomalies

Network Indicators:

DNS query failures
Unexpected authentication persistence

SIEM Query:

Search for keyctl operations with suspicious timing or from unauthorized users

📊 Metadata

CVE ID: CVE-2024-36031

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-324

Published: May 30, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-36031, you might also want to check these: