4.7

CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb()

Modified
AliasesUBUNTU-CVE-2024-36927DEBIAN-CVE-2024-36927
Published 30-05-2024Last modified 15-10-2026

Vulnerability summary

CVE-2024-36927 is a medium (CVSS 4.7) vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
4.7/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 32 · Related 23
DLA-4271-1DLA-4475-1DSA-5925-1MGASA-2024-0263MGASA-2024-0266RHSA-2024:5101

Timeline

  1. 30-05-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN. Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket. Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout. Initialize these explicitly in raw_sendmsg(). [1] BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu124 products
  • linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-40.40
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1013.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 566785731c6dd41ef815196ddc36d1ae30a63763, < 88c66f1879f322f11de34d37b2d3d87497afdcb6 | ≥ a54ec573d9b81b05d368f8e6edc1b3e49f688658, < 20d3eb00ab81462d554ac6d09691b8d9aa5a5741 | ≥ fc60067260c20da8cddcf968bec47416f3e2cde2, < 55bf541e018b76b3750cb6c6ea18c46e1ac5562e | ≥ 99e5acae193e369b71217efe6f1dad42f3f18815, < 5db08343ddb1b239320612036c398e4e1bb52818 | ≥ 99e5acae193e369b71217efe6f1dad42f3f18815, < f5c603ad4e6fcf42f84053e882ebe20184bb309e | ≥ 99e5acae193e369b71217efe6f1dad42f3f18815, < fc1092f51567277509563800a3c56732070b6aa4 | dc4e3bb0710178c8d03fc43064e0a71fe7440cdd | 022ea4374c319690c804706bda9dc42946d1556d | 27c468ec1af113f6ae94fb5378f65e6038bd16e7 | 32a5a13d556e4f804e5a447a08c70b172d600707 | 9e3c96aed8fe32907e0a4bca05aad457629a820c | ≥ 5.10.180, < 5.10.248 | ≥ 5.15.111, < 5.15.198 | ≥ 6.1.28, < 6.1.140 | ≥ 4.14.315, < 4.15 | ≥ 4.19.283, < 4.20 | ≥ 5.4.243, < 5.5 | ≥ 6.2.15, < 6.3 | ≥ 6.3.2, < 6.4 | 6.4
  • linux_kernel≥ 4.14.315, < 4.15 | ≥ 4.19.283, < 4.20 | ≥ 5.4.243, < 5.5 | ≥ 5.10.180, < 5.11 | ≥ 5.15.111, < 5.16 | ≥ 6.1.28, < 6.2 | ≥ 6.2.15, < 6.3 | ≥ 6.3.2, < 6.6.31 | ≥ 6.7, < 6.8.10 | 6.9:rc1 | 6.9:rc2 | 6.9:rc3 | 6.9:rc4 | 6.9:rc5 | 6.9:rc6
Debian1 product
  • linux< 6.1.140-1 | < 6.8.11-1

3 vendors · 127 products

References

28 links
Show all 28 references