CVE-2024-36934

Q: What is the severity of CVE-2024-36934?

CVE-2024-36934 has a CVSS score of 7.8 (HIGH). This CVE-2024-36934 is a Linux kernel vulnerability in the bna driver where improper memory handling allows out-of-bounds read. Attackers could exploit this to read kernel memory, potentially leading to information disclosure or system crashes. Systems using affected Linux kernel versions with the bna driver loaded are vulnerable.

7.8 HIGH

📋 TL;DR

This CVE-2024-36934 is a Linux kernel vulnerability in the bna driver where improper memory handling allows out-of-bounds read. Attackers could exploit this to read kernel memory, potentially leading to information disclosure or system crashes. Systems using affected Linux kernel versions with the bna driver loaded are vulnerable.

💻 Affected Systems

Products:

Linux kernel with bna driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if bna driver is loaded/used (Broadcom NetXtreme II network driver)

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation, system compromise, or complete system crash/DoS

🟠

Likely Case

Information disclosure from kernel memory or system instability/crash

🟢

If Mitigated

Minimal impact if bna driver not loaded or systems properly segmented

🌐 Internet-Facing: MEDIUM - Requires local access or ability to load kernel modules

🏢 Internal Only: MEDIUM - Local attackers could exploit if they have access to vulnerable systems

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to interact with bna driver interface

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 06cb37e2ba6441888f24566a997481d4197b4e32 and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/06cb37e2ba6441888f24566a997481d4197b4e32

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify bna driver is using memdup_user_nul instead of memdup_user.

🔧 Temporary Workarounds

Disable bna driver

linux

Unload or blacklist the bna kernel module if not needed

sudo rmmod bna
echo 'blacklist bna' | sudo tee /etc/modprobe.d/blacklist-bna.conf

🧯 If You Can't Patch

Ensure bna driver is not loaded on critical systems
Implement strict access controls to prevent unauthorized users from interacting with kernel interfaces

🔍 How to Verify

Check if Vulnerable:

Check if bna module is loaded: lsmod | grep bna AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated AND check bna driver source uses memdup_user_nul

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes related to bna driver
Unexpected memory access errors

Network Indicators:

Unusual local system calls to bna interfaces

SIEM Query:

process.name:"bna" OR kernel.panic OR kernel.oops

📊 Metadata

CVE ID: CVE-2024-36934

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 30, 2024

Last Updated: January 22, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable bna driver

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities