CVE-2024-36929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36929
In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 Patch
https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec Patch
https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 Patch
https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 Patch
https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 Patch
https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 Patch
https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 Patch
https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec Patch
https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 Patch
https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 Patch
https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 Patch
https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html Third Party Advisory
https://security.netapp.com/advisory/ntap-20240905-0010/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

22 Jan 2026, 20:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 - () https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 - Patch
References () https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec - () https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec - Patch
References () https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 - () https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 - Patch
References () https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 - () https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 - Patch
References () https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 - () https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 - Patch
References () https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 - () https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240905-0010/ - () https://security.netapp.com/advisory/ntap-20240905-0010/ - Third Party Advisory
CWE CWE-476
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

21 Nov 2024, 09:22

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -
  • () https://security.netapp.com/advisory/ntap-20240905-0010/ -
References () https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 - () https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62 -
References () https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec - () https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec -
References () https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 - () https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533 -
References () https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 - () https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6 -
References () https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 - () https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681 -
References () https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 - () https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1 -

05 Nov 2024, 10:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 14:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: core: rechazar skb_copy(_expand) para fraglist GSO skbs Los skbs SKB_GSO_FRAGLIST no deben linealizarse; de lo contrario, dejarán de ser válidos. Devuelve NULL si dicho skb se pasa a skb_copy o skb_copy_expand, para evitar un bloqueo en una posible llamada posterior a skb_gso_segment.

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2026-01-22 20:03

NVD link : CVE-2024-36929

Mitre link : CVE-2024-36929

CVE.ORG link : CVE-2024-36929

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference