CVE-2024-36971: Android Kernel Remote Code Execution Vulnerability
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: fix dstnegativeadvice() race
dstnegativeadvice() does not enforce proper RCU rules when sk->dstcache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->skdstcache, then call dstrelease(olddst).
Note that skdstreset(sk) is implementing this protocol correctly, while dstnegativeadvice() uses the wrong order.
Given that ip6negativeadvice() has special logic against RTFCACHE, this means each of the three ->negativeadvice() existing methods must perform the skdstreset() themselves.
Note the check against NULL dst is centralized in dstnegativeadvice(), there is no need to duplicate it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
— IBM
In the Linux kernel, the following vulnerability has been resolved:
net: fix dstnegativeadvice() race
The Linux kernel CVE team has assigned CVE-2024-36971 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/20240610090330.1347021-2-lee@kernel.org/T
— Red Hat
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36971?
CVE-2024-36971 is a critical vulnerability that allows for remote code execution in the Android kernel.
How do I fix CVE-2024-36971?
To mitigate CVE-2024-36971, update your Android kernel to the versions recommended by your vendor.
Which systems are affected by CVE-2024-36971?
CVE-2024-36971 impacts various products including the Android OS and certain versions of the Linux kernel.
What kind of attacks can exploit CVE-2024-36971?
CVE-2024-36971 can be exploited via targeted remote code execution attacks.
When was CVE-2024-36971 discovered?
CVE-2024-36971 was identified in 2024 and is associated with active exploitation.