CVE-2024-36938
📋 TL;DR
A race condition vulnerability in the Linux kernel's BPF subsystem allows a NULL pointer dereference when processing socket messages. This can cause kernel crashes or denial of service. Systems running affected Linux kernel versions with BPF socket map functionality enabled are vulnerable.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially requiring physical reboot.
Likely Case
System instability, kernel crashes, or denial of service affecting network functionality.
If Mitigated
Minor performance impact from proper locking implementation with no security impact.
🎯 Exploit Status
Requires race condition timing and specific socket operations. Discovered through syzkaller fuzzing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel commits listed in references (e.g., 39dc9e1442385d6e9be0b6491ee488dddd55ae27)
Vendor Advisory: https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from official kernel.org or distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.
🔧 Temporary Workarounds
Disable BPF socket maps
linuxDisable or avoid using BPF socket map functionality if not required
echo 0 > /proc/sys/net/core/bpf_jit_enable
Remove BPF programs using socket maps
🧯 If You Can't Patch
- Restrict BPF functionality to trusted users only
- Implement strict process isolation and resource limits
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if BPF socket map functionality is enabled: uname -r and check for BPF socket map usageCheck Version:
uname -rVerify Fix Applied:
Verify kernel version matches patched release and test BPF socket map functionality📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- NULL pointer dereference errors in kernel logs
- System crash/reboot events
Network Indicators:
- Sudden loss of socket connectivity
- Abnormal BPF program termination
SIEM Query:
source="kernel" AND ("NULL pointer" OR "sk_psock" OR "KCSAN" OR "data-race")🔗 References
- https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27
- https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d
- https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365
- https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80
- https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87
- https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973
- https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27
- https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d
- https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365
- https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80
- https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87
- https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973
