{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-36963 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-36963 is a high-severity vulnerability in Linux kernel, published on 3 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-36963 and fix it if it is affected.\n\nWhat it is: CVE-2024-36963 is a high-severity vulnerability in Linux kernel, published on 3 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-36963 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-36963/ (Markdown: https://insights.sbomify.com/CVE-2024-36963/index.md)","id":"CVE-2024-36963","markdown":"https://insights.sbomify.com/CVE-2024-36963/index.md","name":"CVE-2024-36963","record":{"aliases":["BELL-CVE-2024-36963","DEBIAN-CVE-2024-36963","GHSA-2r24-5j8r-cf83","UBUNTU-CVE-2024-36963"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel tracefs","requires_auth":"low_privilege","summary":"Linux kernel tracefs fails to reset permissions on remount for modified files, allowing unauthorized access if admins assume remount updates all permissions.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Reset permissions on remount if permissions are options\n\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\n\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\n\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\n\nFor example:\n\n # cd /sys/kernel/tracing\n # chgrp 1002 current_tracer\n # ls -l\n[..]\n -rw-r-----  1 root root 0 May  1 21:25 buffer_size_kb\n -rw-r-----  1 root root 0 May  1 21:25 buffer_subbuf_size_kb\n -r--r-----  1 root root 0 May  1 21:25 buffer_total_size_kb\n -rw-r-----  1 root lkp  0 May  1 21:25 current_tracer\n -rw-r-----  1 root root 0 May  1 21:25 dynamic_events\n -r--r-----  1 root root 0 May  1 21:25 dyn_ftrace_total_info\n -r--r-----  1 root root 0 May  1 21:25 enabled_functions\n\nWhere current_tracer now has group \"lkp\".\n\n # mount -o remount,gid=1001 .\n # ls -l\n -rw-r-----  1 root tracing 0 May  1 21:25 buffer_size_kb\n -rw-r-----  1 root tracing 0 May  1 21:25 buffer_subbuf_size_kb\n -r--r-----  1 root tracing 0 May  1 21:25 buffer_total_size_kb\n -rw-r-----  1 root lkp     0 May  1 21:25 current_tracer\n -rw-r-----  1 root tracing 0 May  1 21:25 dynamic_events\n -r--r-----  1 root tracing 0 May  1 21:25 dyn_ftrace_total_info\n -r--r-----  1 root tracing 0 May  1 21:25 enabled_functions\n\nEverything changed but the \"current_tracer\".\n\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"tracefs: Reset permissions on remount if permissions are options","id":"CVE-2024-36963","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"security_feature_bypass","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"fs/9p: only translate RWX permissions for plain 9P2000","id":"CVE-2024-36964"},"packages":[],"prev":{"headline":"net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs","id":"CVE-2024-36962"},"products":["Linux"],"published":"2024-06-03","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"Linux kernel tracefs fails to reset permissions on remount for modified files, allowing unauthorized access if admins assume remount updates all permissions.","url":"https://insights.sbomify.com/CVE-2024-36963/"}