CVE-2024-36938

Aliases:UBUNTU-CVE-2024-36938DEBIAN-CVE-2024-36938

Advisory lineage Upstream: 0 Downstream: 35

Downstream

DEBIAN-CVE-2024-36938 DSA-5747-1 MGASA-2024-0263 MGASA-2024-0266 SUSE-SU-2024:2008-1 SUSE-SU-2024:2019-1

Modified

Published: 30 May 2024, 15:29

Last modified:11 May 2026, 20:17

Vulnerability Summary

Overall Risk (default)

low

22/100

CVSS Score

5.5 MEDIUM

v3.1 (nvd)

EPSS Score

0.24% LOW

0% probability +0.23%

KEV

Not listed

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

30 May 2024, 15:29

Published

Vulnerability first disclosed

11 May 2026, 20:17

Last Modified

Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);". To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.

CVSS Metrics

v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.24%• Percentile: 16%

Techniques & Countermeasures

CWE-476•NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

debian•linux
< 5.10.223-1 | < 6.1.94-1 | < 6.8.11-1 | < 6.8.11-1
ubuntu•linux
< 5.4.0-202.222 | < 5.15.0-118.128 | < 6.8.0-40.40
ubuntu•linux-allwinner-5.19
all
ubuntu•linux-aws
< 5.4.0-1136.146 | < 5.15.0-1067.73 | < 6.8.0-1013.14
ubuntu•linux-aws-5.0
all
ubuntu•linux-aws-5.11
all
ubuntu•linux-aws-5.13
all
ubuntu•linux-aws-5.15
< 5.15.0-1067.73~20.04.1
ubuntu•linux-aws-5.19
all
ubuntu•linux-aws-5.3
all
ubuntu•linux-aws-5.4
< 5.4.0-1136.146~18.04.1
ubuntu•linux-aws-5.8
all
ubuntu•linux-aws-6.2
all
ubuntu•linux-aws-6.5
all
ubuntu•linux-aws-6.8
< 6.8.0-1013.14~22.04.1
ubuntu•linux-aws-fips
< 5.4.0-1136.146+fips1 | all | < 5.15.0-1067.73+fips1
ubuntu•linux-azure
all | < 5.4.0-1142.149 | < 5.15.0-1070.79 | < 6.8.0-1012.14
ubuntu•linux-azure-5.11
all
ubuntu•linux-azure-5.13
all
ubuntu•linux-azure-5.15
< 5.15.0-1070.79~20.04.1
ubuntu•linux-azure-5.19
all
ubuntu•linux-azure-5.3
all
ubuntu•linux-azure-5.4
< 5.4.0-1142.149~18.04.1
ubuntu•linux-azure-5.8
all
ubuntu•linux-azure-6.2
all
ubuntu•linux-azure-6.5
all
ubuntu•linux-azure-6.8
< 6.8.0-1012.14~22.04.1
ubuntu•linux-azure-edge
all
ubuntu•linux-azure-fde
all | < 5.15.0-1070.79.1
ubuntu•linux-azure-fde-5.19
all
ubuntu•linux-azure-fde-6.2
all
ubuntu•linux-azure-fips
< 5.4.0-1142.149+fips1 | all | < 5.15.0-1070.79+fips1
ubuntu•linux-bluefield
all | < 5.4.0-1096.103 | < 5.15.0-1050.52
ubuntu•linux-fips
< 5.4.0-1110.120 | all | < 5.15.0-118.128+fips1 | < 6.8.0-78.78+fips1
ubuntu•linux-gcp
all | < 5.4.0-1140.149 | < 5.15.0-1066.74 | < 6.8.0-1012.13
ubuntu•linux-gcp-5.11
all
ubuntu•linux-gcp-5.13
all
ubuntu•linux-gcp-5.15
< 5.15.0-1066.74~20.04.1
ubuntu•linux-gcp-5.19
all
ubuntu•linux-gcp-5.3
all
ubuntu•linux-gcp-5.4
< 5.4.0-1140.149~18.04.1
ubuntu•linux-gcp-5.8
all
ubuntu•linux-gcp-6.2
all
ubuntu•linux-gcp-6.5
all
ubuntu•linux-gcp-6.8
< 6.8.0-1012.13~22.04.1
ubuntu•linux-gcp-fips
< 5.4.0-1140.149+fips1 | all | < 5.15.0-1066.74+fips1
ubuntu•linux-gke
all | < 5.15.0-1064.70 | < 6.8.0-1008.11
ubuntu•linux-gke-4.15
all
ubuntu•linux-gke-5.15
all
ubuntu•linux-gke-5.4
all

Showing first 50 affected entries in server-rendered view.