CVE-2024-36938: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's BPF subsystem, specifically in the sk_psock_skb_ingress_enqueue function (CVE-2024-36938). The vulnerability affects Linux kernel versions from 4.20 up to versions before 5.15.159, 6.1.91, 6.6.31, and 6.8.10 (NVD).

The vulnerability stems from a data race condition in sk_psock_skb_ingress_enqueue where a NULL pointer dereference can occur due to lack of proper protection of saved_data_ready. The issue is similar to a previous vulnerability fixed by commit 4cd12c6065df. The bug manifests as a race between sk_psock_drop and sk_psock_skb_ingress_enqueue functions, where one thread can write to a memory location while another thread is reading from it (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a denial of service condition through a NULL pointer dereference in the kernel. When exploited, it could cause system crashes or instability, affecting system availability (NVD).

The vulnerability requires local access and low privileges to exploit. It was discovered and reported by the Kernel Concurrency Sanitizer (KCSAN) during testing, indicating it can be triggered through specific socket operations (Kernel Patch).

The vulnerability has been fixed by adding proper locking mechanisms using sk_callback_lock read lock to protect the saved_data_ready access. The fix involves moving lock pairs into the sk_psock_data_ready function as suggested by John Fastabend. Users should update to kernel versions 5.15.159, 6.1.91, 6.6.31, 6.8.10 or later to receive the fix (Kernel Patch).