CVE-2024-36476 RDMA/rtrs: Ensure 'ib_sge list' is accessible
A null pointer dereference in the Linux kernel RDMA subsystem allows attackers to cause a system crash via crafted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36476?
CVE-2024-36476 is a critical vulnerability in Linux kernel, published on 15 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs: Ensure 'ib_sge list' is accessible
Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function.
Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10
This change ensures the variable is available for subsequent operations that require it.
[1] https://lore.kernel.org/linux-rdma/[email protected]/
Weakness: CWE-476
Which versions are affected by CVE-2024-36476?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-36476?
Apply the vendor's patch.
Is CVE-2024-36476 being exploited?
There is no known exploitation of CVE-2024-36476 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-55838, AZL-55872, BELL-CVE-2024-36476, DEBIAN-CVE-2024-36476, GHSA-jhgr-2wpg-7p64, UBUNTU-CVE-2024-36476.