Background exploitation KEV catalog

CVE-2024-36971

Android Kernel Remote Code Execution Vulnerability

CheckOps priority index

4.4/10 Patch within 7 days

Severity7.8

Probability0.3

Exploitation2/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 2.7% higher than 85.9% of CVEs

CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:

Exploited for 818 days 07 Aug 2024

CISA due date 28 Aug 2024 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 2 / 5

KEV catalog (CISA)07 Aug 2024
Exploited in EUVD (ENISA)07 Aug 2024
Used by ransomwareno
EPSS above 10 %2.7%
No account, over the networkno

What to do

Fix

Update to a fixed version: 6.1.94-1 6.9.7-1

CISA guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

Affected products

LinuxKernel

Affected versions

patch: 6.6.34
a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 <eacb8b195579c174a6d3e12a9690b206eb7f28cf
patch: 5.10.219
patch: 4.19.316
patch: 6.1.94
a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 <b8af8e6118a6605f0e495a58d591ca94a85a50fc
a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 <92f1655aa2b2294d0b49925f3b875a634bd3b59e
a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 <db0082825037794c5dba9959c9de13ca34cc5e72
patch: 5.4.278
patch: 5.15.161
a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314 <2295a7ef5c8c49241bff769e7826ef2582e532a6
4.6

Weaknesses (CWE)

CWE-416

Open source packages OSV

linuxDebian:12 · CVE-2024-36971
fixed in 6.1.94-1
linuxDebian:13 · CVE-2024-36971
fixed in 6.9.7-1

Timeline

10 Jun 2024
Published
07 Aug 2024
Exploitation reported (ENISA)
07 Aug 2024
Added to the KEV catalog
28 Aug 2024
CISA remediation due date

References

Other exploited vulnerabilities from the same vendor

CVE-2025-48595Android Framework Integer Overflow Vulnerability
4.6 · Actively exploited
CVE-2025-48633Android Framework Information Disclosure Vulnerability
3.4 · Background exploitation
CVE-2025-48572Android Framework Privilege Escalation Vulnerability
4.3 · Background exploitation
CVE-2025-48543Android Runtime Use-After-Free Vulnerability
4.7 · Background exploitation
CVE-2024-43093Android Framework Privilege Escalation Vulnerability
4.1 · Background exploitation
CVE-2024-32896Android Pixel Privilege Escalation Vulnerability
5.1 · Background exploitation