CVE-2024-36964: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36964 affects the Linux kernel's 9P filesystem implementation. The vulnerability was discovered and disclosed on June 3, 2024, and involves a permission translation issue in the fs/9p subsystem. Specifically, the vulnerability affects how plain 9P2000's permission bits are handled, allowing unintended permission bits (including the suid bit) to be set (NVD).

The vulnerability exists in the p9mode2perm function within fs/9p/vfs_inode.c where garbage bits in plain 9P2000's permission bits were allowed through. The issue stems from using S_IALLUGO instead of limiting the permission mask to 0777 (S_IRWXUGO) for RWX permissions. This implementation flaw allows setting extended permission bits, including the suid bit, which was not intended for plain 9P2000 protocol (Kernel Commit).

The vulnerability could allow setting unintended permission bits, including the suid bit, which could potentially lead to privilege escalation. This is particularly concerning as the unix extended bits are supposed to be handled explicitly and conditionally on .u extension (NVD).

The vulnerability requires access to a system using the 9P filesystem implementation in the Linux kernel. The issue specifically affects the permission translation mechanism when using plain 9P2000 protocol (Kernel Commit).

The vulnerability has been fixed in various Linux kernel versions through a patch that modifies the permission translation to only use the RWX bits (0777) for plain 9P2000. Multiple Linux distributions have released updates incorporating this fix, including Ubuntu which has patched various kernel versions (Ubuntu Security).