CVE-2024-36270: netfilter: tproxy: bail out if IP has been disabled on the device
In the Linux kernel, the following vulnerability has been resolved:
netfilter: tproxy: bail out if IP has been disabled on the device
syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nftproxyladdr4+0xb7/0x340 net/ipv4/netfilter/nftproxyipv4.c:62 Call Trace: nfttproxyevalv4 net/netfilter/nfttproxy.c:56 [inline] nfttproxyeval+0xa9a/0x1a00 net/netfilter/nfttproxy.c:168
indevgetrcu() can return NULL, so check for this.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
netfilter: tproxy: bail out if IP has been disabled on the device
The Linux kernel CVE team has assigned CVE-2024-36270 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062135-CVE-2024-36270-f7f7@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference error. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36270?
CVE-2024-36270 is a critical vulnerability that can lead to a general protection fault in the Linux kernel.
How do I fix CVE-2024-36270?
To fix CVE-2024-36270, upgrade your Linux kernel to versions 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, or 6.10.
What versions of the Linux kernel are affected by CVE-2024-36270?
CVE-2024-36270 affects various versions of the Linux kernel, including those prior to 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, and 6.9.4.
Is there a workaround for CVE-2024-36270?
Currently, the best approach to mitigate CVE-2024-36270 is to update to a patched version of the kernel.
Which products are affected by CVE-2024-36270?
CVE-2024-36270 mainly affects the Linux kernel and the F5 Traffix SDC version 5.2.0.