CVE-2024-36476CWE-476

CVE-2024-36476

Critical · published January 15, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Ensure 'ib_sge list' is accessible

Move the declaration of the 'ib_sge list' variable outside the

'always_invalidate' block to ensure it remains accessible for use

throughout the function.

Previously, 'ib_sge list' was declared within the 'always_invalidate'

block, limiting its accessibility, then caused a

'BUG: kernel NULL pointer dereference'[1].

? __die_body.cold+0x19/0x27

? page_fault_oops+0x15a/0x2d0

? search_module_extables+0x19/0x60

? search_bpf_extables+0x5f/0x80

? exc_page_fault+0x7e/0x180

? asm_exc_page_fault+0x26/0x30

? memcpy_orig+0xd5/0x140

rxe_mr_copy+0x1c3/0x200 [rdma_rxe]

? rxe_pool_get_index+0x4b/0x80 [rdma_rxe]

copy_data+0xa5/0x230 [rdma_rxe]

rxe_requester+0xd9b/0xf70 [rdma_rxe]

? finish_task_switch.isra.0+0x99/0x2e0

rxe_sender+0x13/0x40 [rdma_rxe]

do_task+0x68/0x1e0 [rdma_rxe]

process_one_work+0x177/0x330

worker_thread+0x252/0x390

? __pfx_worker_thread+0x10/0x10

This change ensures the variable is available for subsequent operations

that require it.

[1] https://lore.kernel.org/linux-rdma/[email protected]/

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-01-15T18:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 5.8, < 5.10.2335.10.233
linux/linux_kernel≥ 5.11, < 5.15.1765.15.176
linux/linux_kernel≥ 5.16, < 6.1.1246.1.124
linux/linux_kernel≥ 6.2, < 6.6.706.6.70
linux/linux_kernel≥ 6.7, < 6.12.96.12.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (8)
EPSS history
Timeline
  • 15 JAN 13:10Z
    RDMA/rtrs: Ensure 'ib_sge list' is accessible
    cvelistv5