60
CVE-2024-36971
KEVmassUse-after-free in Linux kernel network dst cache (CVE-2024-36971), exploited on Android
CISA: Android Kernel Remote Code Execution Vulnerability
CVSS 3.1
7.8 high
EPSS
3%p85
Published
()
KEV added
AI analysis
CVE-2024-36971 is a use-after-free (CWE-416) race condition in the Linux kernel networking stack: __dst_negative_advice() clears a socket's cached destination (sk->sk_dst_cache) in the wrong order relative to RCU rules and dst_release(), which can free the destination entry while it is still referenced. The bug is reachable through UDP socket operations, and CISA catalogs the impact as remote code execution in the affected kernel (Android Kernel), although the published CVSS 3.1 vector scores a local attack vector (7.8 High, AV:L). An attacker who triggers the race gains code execution in kernel context, meaning on Android a malicious app could potentially escape its sandbox and take full control of the device, with high impact on confidentiality, integrity, and availability. Affected systems include Android devices running vulnerable kernels and Linux-based systems listed in the CPE data (upstream Linux kernel and Debian Linux), with no specific vulnerable version ranges disclosed in the available data. The flaw is being actively exploited: Google warned of in-the-wild exploitation (the issue was tracked by researcher Clement Lecigne), CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-07, and EPSS estimates a ~2.7% probability of exploitation in the next 30 days; no public PoC is known.
What to do: Install Android security updates from Google and device OEMs (Google has already shipped patches) and verify your device's security patch level is current. Debian and other Linux users should update kernel packages to builds containing the upstream fix for the __dst_negative_advice() race. Because CISA added this to KEV on 2024-08-07 with active exploitation, apply vendor mitigations promptly or discontinue use if mitigations are unavailable.
Affected
| Linux kernel | — |
| Debian Linux (linux kernel packages) | — |
| Google / Android Android kernel | — |
Estimated exposure
masson the order of billions of Android devices potentially affected pre-patch (upper bound), plus a large installed base across Linux/Debian systems — Android runs on roughly 3 billion active devices, all of which use a Linux kernel with the affected networking code, and the vulnerable kernel code has broad reach across Linux servers and embedded systems; since exact vulnerable version…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
CISA Known Exploited Vulnerability
- Affected
- Android Kernel
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown