CVE-2024-36971
Android Kernel Remote Code Execution Vulnerability
Description
CVE-2024-36971 is a high-severity use-after-free vulnerability in the Linux kernel's networking subsystem with a CVSS v3.1 base score of 7.8. The flaw exists in the __dst_negative_advice() function, where improper RCU (Read-Copy-Update) rule enforcement when clearing sk->dst_cache leads to a race condition that can result in a use-after-free (UAF) condition. CISA has added CVE-2024-36971 to the Known Exploited Vulnerabilities (KEV) catalog under the Android Kernel product with a remediation deadline of August 28, 2024, and the ransomware association is classified as unknown. The EPSS score of 0.60% at the 69.0th percentile indicates moderate exploitation activity. The vulnerability affects Linux kernel versions from 4.6 through 6.9.3 across multiple release branches.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 10.0 |
| linux | linux kernel | >= 4.6, < 4.19.316; >= 4.20, < 5.4.278; >= 5.5, < 5.10.219; >= 5.11, < 5.15.161; >= 5.16, < 6.1.94; >= 6.2, < 6.6.34; >= 6.7, < 6.9.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13(Patch)
- https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6(Patch)
- https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508(Patch)
- https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4(Patch)
- https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e(Patch)
- https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc(Patch)
- https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72(Patch)
- https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf(Patch)
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971(US Government Resource)
Weakness Type
Use-After-Free in Linux Kernel Networking (dst_cache Race)
CVE-2024-36971 is a use-after-free vulnerability caused by a race condition in the Linux kernel's destination cache management. The __dst_negative_advice() function is responsible for handling negative routing advice by clearing the socket's destination cache entry. The correct RCU protocol requires first clearing sk->sk_dst_cache and then calling dst_release(old_dst). However, the vulnerable code path does not properly enforce this ordering, allowing a scenario where the destination structure is released while another thread still holds a reference through the socket's cache pointer. Use-after-free vulnerabilities in kernel networking code are particularly dangerous because they can be triggered through normal network operations and can lead to arbitrary kernel code execution.
Learn more about use-after-free vulnerabilities: CWE-416: Use After Free
Impact Analysis
The business impact of CVE-2024-36971 is severe, with maximum ratings across confidentiality, integrity, and availability. Confidentiality is fully compromised (C:H) because successful exploitation grants kernel-level code execution, enabling the attacker to read any data in kernel memory, including credentials, encryption keys, network traffic buffers, and any other sensitive information processed by the operating system.
Integrity faces maximum impact (I:H) as kernel-level access allows the attacker to modify any system data, install rootkits that operate below the detection capabilities of user-space security tools, alter network traffic in transit, and manipulate process memory and execution flow.
Availability is fully at risk (A:H) because kernel exploitation can cause system crashes, enable ransomware deployment with root privileges, or allow the attacker to disrupt critical services running on the affected system. The local attack vector (AV:L) requires the attacker to have existing access to the system, but on Android devices (the primary KEV target), this can be achieved through malicious applications. The low complexity (AC:L) and low privilege requirement (PR:L) make exploitation accessible once initial access is obtained. The EPSS score of 0.60% at the 69.0th percentile indicates targeted rather than mass exploitation, consistent with the Android kernel context where the vulnerability is used in sophisticated mobile device attacks.
Exploit Maturity
CVE-2024-36971 has confirmed active exploitation, as demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog under the Android Kernel classification with a remediation deadline of August 28, 2024. The EPSS score of 0.60% at the 69.0th percentile reflects targeted exploitation activity, which is typical for kernel vulnerabilities that are used in sophisticated attack campaigns against mobile devices.
Multiple kernel patches addressing the race condition have been published across all affected Linux kernel branches, available through the kernel.org stable repositories. The vulnerability has been the subject of security advisories from Debian and other Linux distributions. The KEV listing under the Android product category indicates that this vulnerability is being actively exploited in the mobile ecosystem, likely by advanced threat actors or commercial spyware vendors who specialize in mobile device exploitation. The ransomware association is classified as unknown, but kernel-level access on Android provides complete device compromise capabilities.
Remediation
-
Update the Linux kernel to a patched version immediately. Apply the kernel patches from the Linux kernel stable repository. Patched versions include 4.19.316+, 5.4.278+, 5.10.219+, 5.15.161+, 6.1.94+, 6.6.34+, and 6.9.4+ on their respective branches. For Android devices, apply the latest Android security patches that include the kernel fix.
-
Prioritize Android device fleet updates. Since CVE-2024-36971 is listed in KEV under the Android Kernel category, ensure all managed Android devices receive the security update. Configure Mobile Device Management (MDM) policies to enforce security patch levels and flag devices running vulnerable kernel versions.
-
Update Linux distribution kernel packages. For server and desktop Linux deployments, apply distribution-specific kernel updates. Debian, Ubuntu, Red Hat, SUSE, and other distributions have released patched kernel packages. Use your distribution's package manager to update to the latest kernel that includes the fix for CVE-2024-36971.
-
Monitor for kernel exploitation indicators. Deploy kernel-level monitoring tools that can detect anomalous behavior indicative of use-after-free exploitation, including unexpected kernel crashes (oops/panics), suspicious memory allocation patterns, and unusual kernel module loading activity.
-
Restrict application installation on Android devices. Since the local attack vector on Android typically requires a malicious application, enforce policies that restrict app installation to verified sources (Google Play Store or enterprise app stores). Enable Google Play Protect scanning and review app permissions regularly.
Technical Details
CVE-2024-36971 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a high base score of 7.8. The local attack vector (AV:L) requires existing access to the system, which on Android devices can be achieved through a malicious application. The low complexity (AC:L) and low privilege requirement (PR:L) mean a standard user-level process can trigger the vulnerability without special conditions.
The vulnerability resides in the __dst_negative_advice() function within the Linux kernel's networking stack. This function processes negative routing advice by invalidating a socket's cached destination entry. The correct RCU (Read-Copy-Update) protocol for this operation requires first clearing the sk->sk_dst_cache pointer atomically and then releasing the old destination reference via dst_release(). The vulnerable code violates this protocol by releasing the destination reference before or without properly clearing the socket's cache pointer, creating a race window where another thread accessing sk->sk_dst_cache can dereference a freed destination structure. This use-after-free condition can be exploited by an attacker who controls the timing of network operations to reallocate the freed memory with attacker-controlled data, redirecting kernel execution flow to achieve arbitrary code execution at ring-0 privilege level. The fix, implemented by commit 92f1655aa2b, corrects the ordering to use sk_dst_reset(sk), which properly implements the clear-then-release protocol. Affected versions span Linux kernel 4.6 through 6.9.3 across multiple stable branches.
Frequently Asked Questions
What is CVE-2024-36971?
CVE-2024-36971 is a high-severity use-after-free vulnerability in the Linux kernel's networking subsystem, specifically in the __dst_negative_advice() function. It allows a local attacker with low privileges to achieve kernel-level code execution. It carries a CVSS v3.1 score of 7.8.
Why is CVE-2024-36971 listed under Android in the KEV catalog?
CISA lists CVE-2024-36971 under the Android Kernel product because the vulnerability is being actively exploited against Android devices. The Linux kernel is the foundation of the Android operating system, and kernel vulnerabilities can be triggered by malicious Android applications to gain full device compromise.
Which Linux kernel versions are affected by CVE-2024-36971?
The vulnerability affects Linux kernel versions from 4.6 through 6.9.3, spanning multiple release branches. Patched versions include 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.94, 6.6.34, and 6.9.4 and later on their respective branches.
Does CVE-2024-36971 affect Linux servers as well as Android?
Yes, CVE-2024-36971 affects the mainline Linux kernel and therefore impacts Linux servers, desktops, and any system running a vulnerable kernel version. While the KEV listing focuses on Android exploitation, any Linux system running kernel versions 4.6 through 6.9.3 should be patched.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.