CVE-2024-36489: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36489 is a vulnerability in the Linux kernel's TLS (Transport Layer Security) implementation. The issue was discovered in the tlsinit() function where a missing write memory barrier could lead to store-store reordering, potentially causing NULL dereference in tls{setsockopt,getsockopt} functions (Kernel Git).

The vulnerability stems from a race condition in the TLS initialization process. When store-store reordering occurs between ctx->skproto initialization and sk->skprot update, it can result in a NULL dereference. The issue specifically manifests in a scenario where CPU operations can be reordered: ctx->skproto = READONCE(sk->skprot) can be reordered with WRITEONCE(sk->skprot, tlsprots), potentially leading to ctx->sk_proto->setsockopt() accessing a NULL value (Kernel Git).

The vulnerability can lead to NULL pointer dereference in the Linux kernel's TLS implementation, potentially causing system crashes or denial of service conditions (NVD).

The fix involves using rcuassignpointer() which provides release barrier semantics. The patch moves the rcuassignpointer() call after ctx->skproto initialization to ensure proper ordering of operations. This ensures that ctx->skproto is visible before changing sk->skprot in updatesk_prot() (Kernel Git).