Log in Start free

Vulnerability · Published Jan 15, 2025 · Assigned by Linux

CVE-2024-36476RDMA/rtrs: Ensure 'ib_sge list' is accessible

Critical 9.8

In plain English

A critical-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.124-1DEBIAN-CVE-2024-36476
Debian:13linux6.12.9-1DEBIAN-CVE-2024-36476
Debian:14linux6.12.9-1DEBIAN-CVE-2024-36476
Ubuntu:22.04:LTSlinux5.15.0-135.146UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux5.15.0-135.146USN-7387-1
Ubuntu:24.04:LTSlinux6.8.0-60.63UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux6.8.0-60.63USN-7513-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws5.15.0-1080.87UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws5.15.0-1080.87USN-7387-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1029.31UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-aws6.8.0-1029.31USN-7513-1
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1029.31~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1029.31~22.04.1USN-7513-1
Ubuntu:22.04:LTSlinux-azure5.15.0-1084.93UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure5.15.0-1084.93USN-7387-1
Ubuntu:24.04:LTSlinux-azure6.8.0-1029.34UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-azure6.8.0-1029.34USN-7513-3
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1029.34~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1029.34~22.04.1USN-7513-3
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1084.93.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1016.17USN-7522-1
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1016.17UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gcp5.15.0-1079.88USN-7387-1
Ubuntu:22.04:LTSlinux-gcp5.15.0-1079.88UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-gcp6.8.0-1030.32UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-gcp6.8.0-1030.32USN-7515-2
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1030.32~22.04.1USN-7515-2
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1030.32~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gke5.15.0-1077.83USN-7387-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1077.83UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-gke6.8.0-1025.29USN-7515-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1025.29UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1062.70UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1062.70USN-7387-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1012.14UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1012.14USN-7515-2
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-21.21~24.04.1UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-21.21~24.04.1USN-7379-1
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-60.63~22.04.1USN-7513-4
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-60.63~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-ibm5.15.0-1072.75UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-ibm5.15.0-1072.75USN-7387-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1026.26UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-ibm6.8.0-1026.26USN-7513-1
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1026.26~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-intel-iot-realtime5.15.0-1073.75UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1075.81USN-7387-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1075.81UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-kvm5.15.0-1076.81USN-7388-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1076.81UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-135.146USN-7387-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-135.146UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-60.63.1UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-60.63.1USN-7513-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.116.11.0-1011.12~24.04.1USN-7381-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-60.63.1~22.04.1USN-7513-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-60.63.1~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1074.75USN-7387-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1074.75UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1028.31USN-7514-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1028.31UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1028.31~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1028.31~22.04.1USN-7514-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1028.31.1USN-7514-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1028.31.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1033.33UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1033.33USN-7389-1
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1021.21USN-7389-1
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1021.21UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1017.17USN-7382-1
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1017.17UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1028.28UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1028.28USN-7513-3
Ubuntu:22.04:LTSlinux-oracle5.15.0-1077.83USN-7387-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1077.83UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-oracle6.8.0-1026.27USN-7513-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1026.27UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1026.27~22.04.1USN-7513-5
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1026.27~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-raspi5.15.0-1074.77USN-7387-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1074.77UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32USN-7524-1
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-riscv6.8.0-60.63.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-62.65~22.04.1UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-36476
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-36476
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1044.48USN-7390-1
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1044.48UBUNTU-CVE-2024-36476

Affected products (as reported)

VendorProductVersions
Linux Linux 9cb837480424e78ed585376f944088246685aec3 – before 7eaa71f56a6f7ab87957213472dc6d40558627229cb837480424e78ed585376f944088246685aec3 – before 143378075904e78b3b2a810099bcc3b3d82d762f9cb837480424e78ed585376f944088246685aec3 – before 32e1e748a85bd52b20b3857d80fd166d22fa455a9cb837480424e78ed585376f944088246685aec3 – before b238f61cc394d5fef27b26d7d9aa383ebfddabb09cb837480424e78ed585376f944088246685aec3 – before 6ffb5c1885195ae5211a12b4acd2d51843ca41b09cb837480424e78ed585376f944088246685aec3 – before fb514b31395946022f13a08e06a435f53cf9e8b3
Linux Linux 5.8

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References