By zerosday cve bot•August 7, 2024•
cves
CVE-2024-36971: Android Kernel Remote Code Execution Vulnerability (Pentest Lab Guide)
CVE-2024-36971: Technical Deep-Dive (Auto Refreshed)
Generated on 2026-03-25T16:07:08.474Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).
Executive Technical Summary
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
- Context preserved from previous revision: In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Notes: CVE POC repo 자동 수집기
Technical Details
- CVE: CVE-2024-36971
- KEV date added: 2024-08-07
- KEV due date: 2024-08-28
- NVD published: 2024-06-10
- NVD modified: 2025-11-05
- MITRE modified: 2025-11-04
- CVSS base score: 7.8
- CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS exploitability score: 1.8
- CVSS impact score: 5.9
- Attack vector: Local
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
Versions and Products Impacted
- debian / debian linux (versions: 10.0)
- linux / linux kernel (versions: >= 4.6, < 4.19.316)
- linux / linux kernel (versions: >= 4.20, < 5.4.278)
- linux / linux kernel (versions: >= 5.5, < 5.10.219)
- linux / linux kernel (versions: >= 5.11, < 5.15.161)
- linux / linux kernel (versions: >= 5.16, < 6.1.94)
- linux / linux kernel (versions: >= 6.2, < 6.6.34)
- linux / linux kernel (versions: >= 6.7, < 6.9.4)
- Linux / Linux (versions: a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314, a87cb3e48ee86d29868d3f59cfb9ce1a8fa63314)
- Linux / Linux (versions: 4.6)
- linux / linux_kernel (versions: 4.6)
- linux / linux_kernel (versions: a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8, a87cb3e48ee8)
- linux / linux_kernel
Weakness Classification
- CWE-416
Repositories for Lab Validation (Public Examples)
- zulloper/cve-poc | stars: 8 | updated: 2026-03-25 | https://github.com/zulloper/cve-poc
Notes: CVE POC repo 자동 수집기
People and Organizations Mentioned
- Linux
- Android
- Kernel
- zulloper
Practical Defensive Validation (Authorized Only)
- Use only isolated environments and systems you own or are explicitly authorized to test.
- Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
- Use debian / debian linux (versions: 10.0) in isolated VM snapshots (vulnerable vs patched) and compare process tree telemetry before/after updates.
- Validate command-execution prevention policies (AppLocker/WDAC/EDR) with harmless test binaries only.
- Create SIEM detections for suspicious parent-child chains, encoded command usage, and abnormal service creation.
References
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2024-36971
- MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2024-36971
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- KEV notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2024-08-01, https://lore.kernel.org/linux-cve-announce/20240610090330.1347021-2-lee@kernel.org/T/#u ; https://nvd.nist.gov/vuln/detail/CVE-2024-36971
- https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
- https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
- https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
- https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
- https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
- https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
- https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
- https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36971
- Repository example: https://github.com/zulloper/cve-poc
This content is for defensive security training and authorized validation only.