Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-36901— ipv6: prevent NULL dereference in ip6_output()

EPSS 0.01% · P1

Affected Version Matrix 14

VendorProductVersion RangeStatus
LinuxLinux778d80be52699596bf70e0eb0761cf5e1e46088d< 9df3b2474a627994433a87cbf325a562555b17deaffected
778d80be52699596bf70e0eb0761cf5e1e46088d< 2272e2db38f2e85929278146d7c770f22f528579affected
778d80be52699596bf70e0eb0761cf5e1e46088d< ea0cb87402f774b0e1214ffba0f57028b27cf155affected
778d80be52699596bf70e0eb0761cf5e1e46088d< e31b25cc2066d3f2b6c38579253882008d4469b0affected
778d80be52699596bf70e0eb0761cf5e1e46088d< 55f7eb4001ef2a3b48cf039cf263f9ed0ec5a488affected
778d80be52699596bf70e0eb0761cf5e1e46088d< 4db783d68b9b39a411a96096c10828ff5dfada7aaffected
2.6.27affected
< 2.6.27unaffected
… +6 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-36901

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: prevent NULL dereference in ip6_output()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a chance that ip6_dst_idev() returns NULL in ip6_output(). Most places in IPv6 stack deal with a NULL idev just fine, but not here. syzbot reported: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7] CPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237 Code: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff RSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202 RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000 RDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48 RBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad R10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0 R13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000 FS: 00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358 sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248 sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653 sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783 sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline] sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169 sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73 __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234 sctp_connect net/sctp/socket.c:4819 [inline] sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于存在空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 778d80be52699596bf70e0eb0761cf5e1e46088d ~ 9df3b2474a627994433a87cbf325a562555b17de -
LinuxLinux 2.6.27 -

II. Public POCs for CVE-2024-36901

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-36901

请登录查看更多情报信息。

Same Patch Batch · Linux · 2024-05-30 · 93 CVEs total

CVE-2024-36927ipv4: Fix uninit-value access in __ip_make_skb()
CVE-2024-36922wifi: iwlwifi: read txq->read_ptr under lock
CVE-2024-36920scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
CVE-2024-36916blk-iocost: avoid out of bounds shift
CVE-2024-36917block: fix overflow in blk_ioctl_discard()
CVE-2024-36914drm/amd/display: Skip on writeback when it's not applicable
CVE-2024-36915nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
CVE-2024-36913Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
CVE-2024-36919scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
CVE-2024-36925swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
CVE-2024-36924scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
CVE-2024-36926powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
CVE-2024-36928s390/qeth: Fix kernel panic after setting hsuid
CVE-2024-36929net: core: reject skb_copy(_expand) for fraglist GSO skbs
CVE-2024-36930spi: fix null pointer dereference within spi_sync
CVE-2024-36932thermal/debugfs: Prevent use-after-free from occurring after cdev removal
CVE-2024-36931s390/cio: Ensure the copied buf is NUL terminated
CVE-2024-36933nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
CVE-2024-36934bna: ensure the copied buf is NUL terminated
CVE-2024-36935ice: ensure the copied buf is NUL terminated

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-36901

No comments yet

Leave a comment