CVE-2024-36288: SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix loop termination condition in gssfreeintokenpages()
The intoken->pages[] array is not NULL terminated. This results in the following KASAN splat:
KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36288?
CVE-2024-36288 has been assessed to have a potentially high severity due to its implications on memory access.
How do I fix CVE-2024-36288?
To fix CVE-2024-36288, ensure that you are using a patched version of the Linux kernel, specifically versions 5.10.223-1, 6.1.128-1, or later.
Which versions of the Linux kernel are affected by CVE-2024-36288?
CVE-2024-36288 affects versions of the Linux kernel up to 6.9.4 and the specific release 6.10.0-rc1.
Is there any workaround for CVE-2024-36288?
Currently, the most reliable workaround for CVE-2024-36288 is to upgrade to a fixed version of the Linux kernel.
What component of the Linux kernel does CVE-2024-36288 affect?
CVE-2024-36288 specifically affects the SUNRPC component of the Linux kernel.