CVE-2024-36008

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The vulnerability is related to a NULL pointer dereference in the fib validate source() function in the Linux kernel's IPv4 component. This issue can be triggered by syzbot in an old tree and appears to exist in the latest trees as well. The vulnerability can cause a general protection fault, likely due to a non-canonical address. All calls to in dev get rcu() must be checked for a NULL result to prevent this issue.

Recommendations To resolve this issue, update the Linux kernel to version 6.6.37 or later. Ensure that all calls to in dev get rcu() are checked for a NULL result to prevent NULL pointer dereferences. As a temporary workaround, consider disabling the fib validate source() function until a patch is available. However, this may have unintended consequences on network functionality and should be used with caution.