CVE-2024-36933

Q: What is the severity of CVE-2024-36933?

CVE-2024-36933 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's NSH (Network Service Header) GSO segmentation handler could cause kernel memory corruption when processing specially crafted network packets. This affects systems using NSH encapsulation with specific network configurations, potentially leading to denial of service or information disclosure.

5.5 MEDIUM

📋 TL;DR

A vulnerability in the Linux kernel's NSH (Network Service Header) GSO segmentation handler could cause kernel memory corruption when processing specially crafted network packets. This affects systems using NSH encapsulation with specific network configurations, potentially leading to denial of service or information disclosure.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not explicitly stated in CVE description, but patches are available in stable kernel trees.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using NSH (Network Service Header) encapsulation features. Most standard Linux installations are not vulnerable by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential information disclosure from kernel memory, or remote code execution in kernel context.

🟠

Likely Case

Denial of service through kernel crash or system instability when processing malformed NSH-encapsulated packets.

🟢

If Mitigated

Minimal impact if NSH encapsulation is not used or proper network segmentation prevents malicious packets from reaching vulnerable systems.

🌐 Internet-Facing: MEDIUM - Requires specific NSH encapsulation configurations and network paths that allow crafted packets to reach vulnerable systems.

🏢 Internal Only: MEDIUM - Internal systems using NSH encapsulation in virtualized/containerized environments could be affected by malicious internal traffic.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted GSO packets with specific protocol layering (ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP). The vulnerability was discovered through syzbot fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits: 29a07f2ee4d273760c2acbfc756e29eccd82470a, 37ed6f244ec5bda2e90b085084e322ea55d0aaa2, 46134031c20fd313d03b90169d64b2e05ca6b65c, 4b911a9690d72641879ea6d13cce1de31d346d79, 5a4603fbc285752d19e4b415466db18ef3617e4a)

Vendor Advisory: https://git.kernel.org/stable/c/29a07f2ee4d273760c2acbfc756e29eccd82470a

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the fix is applied by checking kernel version.

🔧 Temporary Workarounds

Disable NSH encapsulation

linux

If NSH functionality is not required, disable it to prevent exploitation.

Check if NSH modules are loaded: lsmod | grep nsh
Unload NSH module: rmmod nsh

Network filtering

linux

Block NSH-encapsulated packets at network boundaries using firewall rules.

iptables -A INPUT -m nsh -j DROP
nft add rule ip filter input nsh drop

🧯 If You Can't Patch

Implement strict network segmentation to isolate systems using NSH encapsulation
Deploy network intrusion detection/prevention systems to detect and block malicious NSH packets

🔍 How to Verify

Check if Vulnerable:

Check if NSH module is loaded and kernel version is unpatched: lsmod | grep nsh && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to a patched version and check git commit history for the fix: uname -r && zgrep -i 'nsh.*gso' /proc/config.gz

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KMSAN (Kernel Memory Sanitizer) error reports
Network interface errors when processing NSH packets

Network Indicators:

Unusual NSH-encapsulated traffic patterns
Packets with specific protocol layering (ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP)

SIEM Query:

source="kernel" AND ("KMSAN" OR "uninit-value" OR "nsh_gso_segment" OR "NSH")

📊 Metadata

CVE ID: CVE-2024-36933

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

Published: May 30, 2024

Last Updated: January 22, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable NSH encapsulation

Network filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities