Known Exploited Vulnerability
7.8
HIGH
CVE-2024-36971
Android Kernel Remote Code Execution Vulnerability - [Actively Exploited]
Description

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

INFO

Published Date :

June 10, 2024, 9:15 a.m.

Last Modified :

Aug. 8, 2024, 2:49 p.m.

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2024-08-01, https://lore.kernel.org/linux-cve-announce/[email protected]/T/#u

Affected Products

The following products are affected by CVE-2024-36971 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-36971.

URL Resource
https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 Patch
https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 Patch
https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 Patch
https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 Patch
https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e Patch
https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc Patch
https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 Patch
https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf Patch

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-36971 vulnerability anywhere in the article.

  • Cybersecurity News
Warning: CVE-2024-20469 in Cisco ISE with PoC Code Puts Networks at Risk

A vulnerability, tracked as CVE-2024-20469, has been discovered in Cisco Identity Services Engine (ISE). With a CVSS score of 6.0, this vulnerability allows authenticated, local attackers to elevate p ... Read more

Published Date: Sep 05, 2024 (1 week, 6 days ago)
CVE-2024-20469 CVE-2024-45321 CVE-2024-28986 CVE-2024-7589 CVE-2024-36971
  • Cybersecurity News
D-Link Won’t Fix 4 RCE Vulnerabilities in DIR-846W Router

Four severe security flaws have been found in the D-Link DIR-846W router, leaving users potentially exposed to remote attacks even after the device has reached its end-of-life.Security researchers hav ... Read more

Published Date: Sep 03, 2024 (2 weeks, 1 day ago)
CVE-2024-44342 CVE-2024-44341 CVE-2024-44340 CVE-2024-41622 CVE-2024-21689 CVE-2024-36877 CVE-2024-5290 CVE-2024-3080 CVE-2024-36971 CVE-2024-3273
  • Cybersecurity News
Minecraft Server Hit with Record-Breaking 3.15 Billion Packet Rate DDoS Attack

Carpet Bomb attacks aim to flood traffic to all IPs within a subnet on a victim network, with the goal to bypass per destination attack detection | Image: Global Secure LayerGlobal Secure Layer (GSL), ... Read more

Published Date: Aug 31, 2024 (2 weeks, 4 days ago)
CVE-2024-45321 CVE-2024-28986 CVE-2024-7589 CVE-2024-36971 CVE-2023-2231
  • Cybersecurity News
Intel SGX Security Compromised: Root Provisioning Key Extracted

Recently, researcher Mark Ermolov has successfully extracted Intel’s SGX Fuse Key0, also known as the Root Provisioning Key. This key, introduced with Intel’s Skylake processors, is a cornerstone of I ... Read more

Published Date: Aug 28, 2024 (3 weeks ago)
CVE-2024-6633 CVE-2024-21689 CVE-2024-36877 CVE-2024-5290 CVE-2024-36971 CVE-2019-0090 CVE-2017-5707 CVE-2017-5706 CVE-2017-5705
  • Cybersecurity News
Google Pixel Phones Exposed: Millions at Risk Due to Pre-Installed App Vulnerability

Cybersecurity researchers at iVerify, in collaboration with Palantir Technologies and Trail of Bits, have uncovered a significant vulnerability in millions of Google Pixel devices worldwide. The flaw, ... Read more

Published Date: Aug 16, 2024 (1 month ago)
CVE-2024-38856 CVE-2024-7205 CVE-2024-36971 CVE-2024-30165 CVE-2024-30164 CVE-2024-0646
  • Cybersecurity News
Golddigger and Gigabud Android Banking Trojans: Same Cybercriminal, New Tricks

Icons used by Gigabud malware | Image: CRILA recent investigation by Cyble Intelligence and Research Labs (CRIL) has unveiled a significant connection between two prominent Android banking trojans: Go ... Read more

Published Date: Aug 14, 2024 (1 month ago)
CVE-2024-7589 CVE-2024-39700 CVE-2024-37085 CVE-2024-36971 CVE-2024-21412
  • Cybersecurity News
QuickShell Security Flaw Exposes Google Quick Share Users to Remote Attacks

Image Credit: SafeBreach LabsGoogle’s Quick Share, a popular tool for file sharing across Android, Windows, and Chrome OS devices, has recently come under scrutiny following the discovery of serious s ... Read more

Published Date: Aug 12, 2024 (1 month ago)
CVE-2024-38202 CVE-2024-21302 CVE-2024-20416 CVE-2024-22442 CVE-2024-36401 CVE-2024-38272 CVE-2024-38271 CVE-2024-36971
  • TheCyberThrone
TheCyberThrone Security Week In Review – August 10, 2024

Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, August 10, 2024.Google Fixes Android Zero ... Read more

Published Date: Aug 11, 2024 (1 month, 1 week ago)
CVE-2024-38200 CVE-2024-43045 CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-36268 CVE-2024-36971 CVE-2024-23222 CVE-2018-0824
  • TheCyberThrone
Microsoft Office Zeorday CVE-2024-38200

Microsoft has disclosed the details of an unpatched zero-day in office that could result in unauthorized disclosure of sensitive information to malicious actors.The vulnerability, tracked as CVE-2024- ... Read more

Published Date: Aug 10, 2024 (1 month, 1 week ago)
CVE-2024-38200 CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-36971 CVE-2024-23222
  • Cybersecurity News
Windows Smart App Control, SmartScreen Vulnerable to Exploits

Image: Elastic Security LabsCybersecurity specialists have discovered significant flaws in the protective mechanisms of Microsoft Windows—Smart App Control (SAC) and SmartScreen. The identified vulner ... Read more

Published Date: Aug 10, 2024 (1 month, 1 week ago)
CVE-2024-39700 CVE-2024-37085 CVE-2024-36971 CVE-2024-21412
  • TheCyberThrone
HPE Aruba fixes Several Access Points vulnerabilities

HPE Aruba has released security updates to address multiple critical vulnerabilities in its Aruba Access Points running InstantOS and ArubaOS 10 that could potentially allow unauthorized remote attack ... Read more

Published Date: Aug 09, 2024 (1 month, 1 week ago)
CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-42395 CVE-2024-42394 CVE-2024-42393 CVE-2024-36971 CVE-2024-23222
  • TheCyberThrone
MongoDB fixes High severity vulnerability CVE-2024-7553

MongoDB has released patches for a high-severity vulnerability affecting multiple versions of its server and driver products that could allow a malicious local user to escalate their privileges, poten ... Read more

Published Date: Aug 09, 2024 (1 month, 1 week ago)
CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-36971 CVE-2024-23222
  • TheCyberThrone
Apple fixes Advanced Data Protection flaws with new iOS version release

Apple has released the iOS 17.6.1 update, specifically targets a bug related to Apple’s Advanced Data Protection (ADP) feature. The glitch, which affected a small number of users, made it difficult to ... Read more

Published Date: Aug 09, 2024 (1 month, 1 week ago)
CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-36971 CVE-2024-23222
  • BleepingComputer
CISA warns about actively exploited Apache OFBiz RCE flaw

The U.S. Cybersecurity & Infrastructure Security Agency is warning of two vulnerabilities exploited in attacks, including a path traversal impacting Apache OFBiz. Apache OFBiz (Open For Business) is a ... Read more

Published Date: Aug 08, 2024 (1 month, 1 week ago)
CVE-2024-38856 CVE-2024-36971 CVE-2024-32113
  • TheCyberThrone
Apache Cloudstack fixes CVE-2024-42062 & CVE-2024-42222

Apache CloudStack project has released patches for  addressing  two critical vulnerabilities, that could allow attackers to gain unauthorized access to sensitive information and compromise the integri ... Read more

Published Date: Aug 08, 2024 (1 month, 1 week ago)
CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-39864 CVE-2024-38346 CVE-2024-36971 CVE-2024-36104 CVE-2024-23222
  • TheCyberThrone
Jenkins Patches Critical Vulnerability CVE-2024-43044

Jenkins has released an urgent advisory detailing two vulnerabilities, that expose Jenkins instances to arbitrary file read and unauthorized access risks,The critical one of the two vulnerabilities, t ... Read more

Published Date: Aug 08, 2024 (1 month, 1 week ago)
CVE-2024-43045 CVE-2024-43044 CVE-2024-7553 CVE-2024-42222 CVE-2024-42062 CVE-2024-36971 CVE-2024-23222
  • TheCyberThrone
Google Fixes Android Zeroday Vulnerability CVE-2024-36971

Google has released patches for 46 bugs affecting its Android operating system in its August 2024 security update. This includes an actively exploited kernel vulnerability tracked as CVE-2024-36971 af ... Read more

Published Date: Aug 07, 2024 (1 month, 1 week ago)
CVE-2024-23350 CVE-2024-38856 CVE-2024-36268 CVE-2024-6576 CVE-2024-36971 CVE-2023-36934 CVE-2018-0824
  • The Register
Google splats device-hijacking exploited-in-the-wild Android kernel bug among others

Google released 46 fixes for Android in its August security patch batch, including one for a Linux kernel flaw in the mobile OS that can lead to remote code execution (RCE). From the sounds of things, ... Read more

Published Date: Aug 06, 2024 (1 month, 1 week ago)
CVE-2024-23350 CVE-2024-36971
  • Cyber Security News
Google Patches Actively Exploited Android Kernel Zero-Day Patched

The Android Security Bulletin for August 2024 details vulnerabilities addressed by the 2024-08-05 security patch level. The most critical issue is a high-severity vulnerability in the Framework compon ... Read more

Published Date: Aug 06, 2024 (1 month, 1 week ago)
CVE-2024-36971
  • security.nl
Google waarschuwt voor actief aangevallen RCE-kwetsbaarheid in Android

Google waarschuwt voor een actief aangevallen kwetsbaarheid in de Androidkernel waardoor remote code execution (RCE) mogelijk is. Het techbedrijf heeft updates beschikbaar gemaakt, maar het beveiligin ... Read more

Published Date: Aug 06, 2024 (1 month, 1 week ago)
CVE-2024-36971
  • The Hacker News
Google Patches New Android Kernel Vulnerability Exploited in the Wild

Mobile Security / Vulnerability Google has addressed a high-severity security flaw impacting the Android kernel that it has been actively exploited in the wild. The vulnerability, tracked as CVE-2024- ... Read more

Published Date: Aug 06, 2024 (1 month, 1 week ago)
CVE-2024-32896 CVE-2024-36971 CVE-2024-29748 CVE-2024-29745 CVE-2018-0824
  • BleepingComputer
Google fixes Android kernel zero-day exploited in targeted attacks

Image: MidjourneyAndroid security updates this month patch 46 vulnerabilities, including a high-severity remote code execution (RCE) exploited in targeted attacks. The zero-day, tracked as CVE-2024-36 ... Read more

Published Date: Aug 05, 2024 (1 month, 1 week ago)
CVE-2024-23350 CVE-2024-32896 CVE-2024-36971 CVE-2024-29748

The following table lists the changes that have been made to the CVE-2024-36971 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Aug. 08, 2024

    Action Type Old Value New Value
    Changed Reference Type https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 No Types Assigned https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 Patch
    Changed Reference Type https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 No Types Assigned https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 Patch
    Changed Reference Type https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 No Types Assigned https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 Patch
    Changed Reference Type https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 No Types Assigned https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 Patch
    Changed Reference Type https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 No Types Assigned https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 Patch
    Changed Reference Type https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf No Types Assigned https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf Patch
    Changed CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.6 up to (excluding) 6.9.4 *cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:* OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.6 up to (excluding) 4.19.316 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.278 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.219 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.161 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.34 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.9.4
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Aug. 08, 2024

    Action Type Old Value New Value
    Added Date Added 2024-08-07
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    Added Due Date 2024-08-28
    Added Vulnerability Name Android Kernel Remote Code Execution Vulnerability
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 07, 2024

    Action Type Old Value New Value
    Added CWE CISA-ADP CWE-416
    Added CVSS V3.1 CISA-ADP AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 15, 2024

    Action Type Old Value New Value
    Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 27, 2024

    Action Type Old Value New Value
    Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned]
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 16, 2024

    Action Type Old Value New Value
    Added Reference kernel.org https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 [No types assigned]
  • Initial Analysis by [email protected]

    Jun. 12, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e No Types Assigned https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e Patch
    Changed Reference Type https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc No Types Assigned https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc Patch
    Added CWE NIST CWE-416
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.6 up to (excluding) 6.9.4 *cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:*
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 12, 2024

    Action Type Old Value New Value
    Added Reference kernel.org https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc [No types assigned]
  • CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 10, 2024

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
    Added Reference kernel.org https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-36971 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-36971 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: