CVE-2024-36270 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2024-36270?

CVE-2024-36270 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's netfilter tproxy module allows local attackers to cause a kernel panic (denial of service) or potentially execute arbitrary code. This affects Linux systems with netfilter tproxy functionality enabled. The vulnerability occurs when __in_dev_get_rcu() returns NULL but the code doesn't check for this condition.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's netfilter tproxy module allows local attackers to cause a kernel panic (denial of service) or potentially execute arbitrary code. This affects Linux systems with netfilter tproxy functionality enabled. The vulnerability occurs when __in_dev_get_rcu() returns NULL but the code doesn't check for this condition.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if netfilter tproxy functionality is enabled and configured

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel crash leading to system reboot, or potential privilege escalation to kernel-level code execution

🟠

Likely Case

Local denial of service through kernel panic and system reboot

🟢

If Mitigated

Minimal impact if tproxy functionality is disabled or proper kernel hardening is in place

🌐 Internet-Facing: LOW - Requires local access to trigger

🏢 Internal Only: MEDIUM - Local users or compromised accounts can trigger the vulnerability

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of triggering the specific code path

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes (see references)

Vendor Advisory: https://git.kernel.org/stable/c/07eeedafc59c45fe5de43958128542be3784764c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable tproxy functionality

linux

Remove or disable netfilter tproxy module if not required

modprobe -r nf_tproxy_ipv4
modprobe -r nf_tproxy_ipv6

🧯 If You Can't Patch

Restrict local user access to systems with tproxy enabled
Implement kernel hardening features like KASAN to detect exploitation attempts

🔍 How to Verify

Check if Vulnerable:

Check if tproxy modules are loaded: lsmod | grep tproxy

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases and verify tproxy modules function without crashes

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
NULL pointer dereference errors in kernel logs
System crash/reboot events

Network Indicators:

Unexpected system reboots on servers with tproxy enabled

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "general protection fault" OR "KASAN: null-ptr-deref")

📊 Metadata

CVE ID: CVE-2024-36270

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: June 21, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-36270, you might also want to check these: