CVE-2024-36031: keys: Fix overwrite of key expiration on instantiation
First published: Thu May 30 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <5.10.217 | 5.10.217 |
| redhat/kernel | <5.15.159 | 5.15.159 |
| redhat/kernel | <6.1.91 | 6.1.91 |
| redhat/kernel | <6.6.31 | 6.6.31 |
| redhat/kernel | <6.8.10 | 6.8.10 |
| redhat/kernel | <6.9.1 | 6.9.1 |
| redhat/kernel | <6.10 | 6.10 |
| Linux Kernel | >=5.10.206<5.10.217 | |
| Linux Kernel | >=5.15.146<5.15.159 | |
| Linux Kernel | >=6.1.70<6.1.91 | |
| Linux Kernel | >=6.6.9<6.6.31 | |
| Linux Kernel | >=6.7<6.8.10 | |
| Linux Kernel | >=6.9<6.9.1 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.128-1 6.12.20-1 6.12.21-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7
- https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41
- https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252
- https://git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8a
- https://git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126a
- https://git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06d
- https://git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9be
- https://launchpad.net/bugs/cve/CVE-2024-36031
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36031
- https://nvd.nist.gov/vuln/detail/CVE-2024-36031
- https://security-tracker.debian.org/tracker/CVE-2024-36031
- https://ubuntu.com/security/CVE-2024-36031
- https://git.kernel.org/linus/9da27fb65a14c18efd4473e2e82b76b53ba60252
- https://access.redhat.com/security/cve/CVE-2024-36031
- https://lore.kernel.org/linux-cve-announce/2024053000-CVE-2024-36031-46f2@gregkh/T
- https://access.redhat.com/errata/RHSA-2024:9315
- https://bugzilla.redhat.com/show_bug.cgi?id=2284410
Frequently Asked Questions
What is the severity of CVE-2024-36031?
The severity of CVE-2024-36031 is currently classified as high due to the potential impact on key expiration handling in the Linux kernel.
How do I fix CVE-2024-36031?
To fix CVE-2024-36031, upgrade the Linux kernel to version 5.10.223-1 or later, or 5.15.159 or later, or install the recommended patches from your distribution.
Which Linux kernel versions are affected by CVE-2024-36031?
CVE-2024-36031 affects multiple Linux kernel versions, including versions prior to 5.10.217, 5.15.159, 6.1.91, and others specified by your distribution.
What vulnerabilities are related to key management in the Linux kernel?
CVE-2024-36031 is part of a series of vulnerabilities related to key management, specifically affecting key expiration functionality.
Is CVE-2024-36031 a remote exploit risk?
CVE-2024-36031 does not directly involve remote exploitation but can affect systems that rely on proper key management, potentially leading to security risks.
- agent/title
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/weakness
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-36031
- agent/software-canonical-lookup
- agent/references
- agent/severity
- collector/nvd-cve
- source/NVD
- collector/usn-cve
- source/Ubuntu
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/event
- collector/security-tracker-debian
- source/Debian
- collector/nvd-api
- package-manager/redhat
- package-manager/debian
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.10.206
- version/linux kernel/5.15.146
- version/linux kernel/6.1.70
- version/linux kernel/6.6.9
- version/linux kernel/6.7
- version/linux kernel/6.9