GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36476 (GCVE-0-2024-36476)

Vulnerability from cvelistv5 – Published: 2025-01-15 13:10 – Updated: 2026-08-05 11:31
VLAI
Title
RDMA/rtrs: Ensure 'ib_sge list' is accessible
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:54 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9cb837480424e78ed585376f944088246685aec3 , < 7eaa71f56a6f7ab87957213472dc6d4055862722 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 143378075904e78b3b2a810099bcc3b3d82d762f (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 32e1e748a85bd52b20b3857d80fd166d22fa455a (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < b238f61cc394d5fef27b26d7d9aa383ebfddabb0 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < 6ffb5c1885195ae5211a12b4acd2d51843ca41b0 (git)
Affected: 9cb837480424e78ed585376f944088246685aec3 , < fb514b31395946022f13a08e06a435f53cf9e8b3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.233 , ≤ 5.10.* (semver)
Unaffected: 5.15.176 , ≤ 5.15.* (semver)
Unaffected: 6.1.124 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:29.846906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:18.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:37:45.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7eaa71f56a6f7ab87957213472dc6d4055862722",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "143378075904e78b3b2a810099bcc3b3d82d762f",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "32e1e748a85bd52b20b3857d80fd166d22fa455a",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "b238f61cc394d5fef27b26d7d9aa383ebfddabb0",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "6ffb5c1885195ae5211a12b4acd2d51843ca41b0",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "fb514b31395946022f13a08e06a435f53cf9e8b3",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.233",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.124",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible\n\nMove the declaration of the \u0027ib_sge list\u0027 variable outside the\n\u0027always_invalidate\u0027 block to ensure it remains accessible for use\nthroughout the function.\n\nPreviously, \u0027ib_sge list\u0027 was declared within the \u0027always_invalidate\u0027\nblock, limiting its accessibility, then caused a\n\u0027BUG: kernel NULL pointer dereference\u0027[1].\n ? __die_body.cold+0x19/0x27\n ? page_fault_oops+0x15a/0x2d0\n ? search_module_extables+0x19/0x60\n ? search_bpf_extables+0x5f/0x80\n ? exc_page_fault+0x7e/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? memcpy_orig+0xd5/0x140\n rxe_mr_copy+0x1c3/0x200 [rdma_rxe]\n ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe]\n copy_data+0xa5/0x230 [rdma_rxe]\n rxe_requester+0xd9b/0xf70 [rdma_rxe]\n ? finish_task_switch.isra.0+0x99/0x2e0\n rxe_sender+0x13/0x40 [rdma_rxe]\n do_task+0x68/0x1e0 [rdma_rxe]\n process_one_work+0x177/0x330\n worker_thread+0x252/0x390\n ? __pfx_worker_thread+0x10/0x10\n\nThis change ensures the variable is available for subsequent operations\nthat require it.\n\n[1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The rtrs server listens via RDMA CM on RDMA_PS_TCP (RoCEv2/iWARP, routable over ordinary IP networks) and RDMA_PS_IB, and the vulnerable function is invoked purely in response to messages sent by a remote peer over the established QP. No local access is needed.\nAC:L - The `always_invalidate` module parameter defaults to true, so the defective branch is the default code path, and a single RTRS_MSG_WRITE with an unrecognized RNBD header type (or any ordinary write I/O completion) deterministically reaches `send_io_resp_imm()`. There is no race to win and no memory grooming required.\nPR:N - `rtrs_rdma_connect()` validates only RTRS_MAGIC, the protocol major version, and a UUID chosen by the client \u2014 the RTRS/RNBD wire protocol contains no authentication whatsoever. The `send_err_msg:` path into the vulnerable function is reachable before any block device has been opened on the session.\nUI:N - The server processes incoming RDMA work completions in a kernel workqueue with no operator involvement. No victim action is required beyond the storage server already running rnbd_server/rtrs_server.\nS:U - The dangling stack descriptor is consumed by kernel code and the resulting reads and crash occur within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-lifetime `ib_sge` supplies an unbounded address/length pair under `local_dma_lkey`; `rxe_mr_copy()` short-circuits to `rxe_mr_copy_dma()` before `mr_check_range()`, memcpy\u0027ing from that raw kernel virtual address into the outbound packet with no bounds check. Arbitrary kernel memory is therefore transmitted to the unauthenticated remote peer.\nI:H - The RDMA device is handed a work-request descriptor built entirely from out-of-lifetime memory, and the corrupted rkey response it produces is stored unvalidated by the peer (`clt_path-\u003erbufs[buf_id].rkey = le32_to_cpu(msg-\u003erkey)`), so subsequent server-to-client RDMA writes target an attacker-unintended memory region. Combined with the unchecked DMA-MR access primitive this is treated as a high integrity impact.\nA:H - The reported and reproduced consequence is a kernel page fault oops (`BUG: kernel NULL pointer dereference` in `rxe_mr_copy`/`memcpy_orig` from the `rxe_sender` workqueue), and failed posts additionally drive `close_path()`, tearing down the storage session. This is remotely and repeatedly triggerable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:45.783Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722"
        },
        {
          "url": "https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762f"
        },
        {
          "url": "https://git.kernel.org/stable/c/32e1e748a85bd52b20b3857d80fd166d22fa455a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b238f61cc394d5fef27b26d7d9aa383ebfddabb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ffb5c1885195ae5211a12b4acd2d51843ca41b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb514b31395946022f13a08e06a435f53cf9e8b3"
        }
      ],
      "title": "RDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36476",
    "datePublished": "2025-01-15T13:10:20.507Z",
    "dateReserved": "2025-01-15T13:08:59.730Z",
    "dateUpdated": "2026-08-05T11:31:45.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36476",
      "date": "2026-09-17",
      "epss": "0.00644",
      "percentile": "0.49289"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-13T00:00:00.000Z",
      "cve": "CVE-2024-36476",
      "id": "msrc_CVE-2024-36476",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-36476.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36476\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:09.460\",\"lastModified\":\"2026-08-04T11:18:25.513\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible\\n\\nMove the declaration of the \u0027ib_sge list\u0027 variable outside the\\n\u0027always_invalidate\u0027 block to ensure it remains accessible for use\\nthroughout the function.\\n\\nPreviously, \u0027ib_sge list\u0027 was declared within the \u0027always_invalidate\u0027\\nblock, limiting its accessibility, then caused a\\n\u0027BUG: kernel NULL pointer dereference\u0027[1].\\n ? __die_body.cold+0x19/0x27\\n ? page_fault_oops+0x15a/0x2d0\\n ? search_module_extables+0x19/0x60\\n ? search_bpf_extables+0x5f/0x80\\n ? exc_page_fault+0x7e/0x180\\n ? asm_exc_page_fault+0x26/0x30\\n ? memcpy_orig+0xd5/0x140\\n rxe_mr_copy+0x1c3/0x200 [rdma_rxe]\\n ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe]\\n copy_data+0xa5/0x230 [rdma_rxe]\\n rxe_requester+0xd9b/0xf70 [rdma_rxe]\\n ? finish_task_switch.isra.0+0x99/0x2e0\\n rxe_sender+0x13/0x40 [rdma_rxe]\\n do_task+0x68/0x1e0 [rdma_rxe]\\n process_one_work+0x177/0x330\\n worker_thread+0x252/0x390\\n ? __pfx_worker_thread+0x10/0x10\\n\\nThis change ensures the variable is available for subsequent operations\\nthat require it.\\n\\n[1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rtrs: garantizar que \u0027ib_sge list\u0027 sea accesible Mueva la declaraci\u00f3n de la variable \u0027ib_sge list\u0027 fuera del bloque \u0027always_invalidate\u0027 para garantizar que permanezca accesible para su uso en toda la funci\u00f3n. Anteriormente, \u0027ib_sge list\u0027 se declaraba dentro del bloque \u0027always_invalidate\u0027, lo que limitaba su accesibilidad y luego causaba un \u0027BUG: kernel NULL pointer dereference\u0027[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 Este cambio garantiza que la variable est\u00e9 disponible para operaciones posteriores que la requieran. [1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/ulp/rtrs/rtrs-srv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"7eaa71f56a6f7ab87957213472dc6d4055862722\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"143378075904e78b3b2a810099bcc3b3d82d762f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"32e1e748a85bd52b20b3857d80fd166d22fa455a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"b238f61cc394d5fef27b26d7d9aa383ebfddabb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"6ffb5c1885195ae5211a12b4acd2d51843ca41b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9cb837480424e78ed585376f944088246685aec3\",\"lessThan\":\"fb514b31395946022f13a08e06a435f53cf9e8b3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/ulp/rtrs/rtrs-srv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.233\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.176\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.124\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.9\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:54:29.846906Z\",\"id\":\"CVE-2024-36476\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.233\",\"matchCriteriaId\":\"463F1B36-7CA5-467C-9F89-6700241AC8F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.176\",\"matchCriteriaId\":\"DDBD8FC6-2357-4347-BFA1-B4A4A3039F35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.124\",\"matchCriteriaId\":\"1B69CE1B-5219-42EB-B7DD-7E7D7F1DB032\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"51E6CFF2-92AA-4936-95AB-2D068168A696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"1D13AF97-FFED-4B68-906D-CFE38D0B88DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32e1e748a85bd52b20b3857d80fd166d22fa455a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6ffb5c1885195ae5211a12b4acd2d51843ca41b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b238f61cc394d5fef27b26d7d9aa383ebfddabb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb514b31395946022f13a08e06a435f53cf9e8b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:42+00:00",
      "cve": "CVE-2024-36476",
      "id": "CVE-2024-36476",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36476.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:23:44Z",
      "cve": "CVE-2024-36476",
      "id": "CVE-2024-36476",
      "initial_release_date": "2025-01-16T04:02:59Z",
      "product_status:known_affected": "565",
      "product_status:known_not_affected": "227",
      "product_status:recommended": "358",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36476",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36476.json",
      "version": "97"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:37:45.505Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36476\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:54:29.846906Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:54:18.041Z\"}}], \"cna\": {\"title\": \"RDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The rtrs server listens via RDMA CM on RDMA_PS_TCP (RoCEv2/iWARP, routable over ordinary IP networks) and RDMA_PS_IB, and the vulnerable function is invoked purely in response to messages sent by a remote peer over the established QP. No local access is needed.\\nAC:L - The `always_invalidate` module parameter defaults to true, so the defective branch is the default code path, and a single RTRS_MSG_WRITE with an unrecognized RNBD header type (or any ordinary write I/O completion) deterministically reaches `send_io_resp_imm()`. There is no race to win and no memory grooming required.\\nPR:N - `rtrs_rdma_connect()` validates only RTRS_MAGIC, the protocol major version, and a UUID chosen by the client \\u2014 the RTRS/RNBD wire protocol contains no authentication whatsoever. The `send_err_msg:` path into the vulnerable function is reachable before any block device has been opened on the session.\\nUI:N - The server processes incoming RDMA work completions in a kernel workqueue with no operator involvement. No victim action is required beyond the storage server already running rnbd_server/rtrs_server.\\nS:U - The dangling stack descriptor is consumed by kernel code and the resulting reads and crash occur within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The out-of-lifetime `ib_sge` supplies an unbounded address/length pair under `local_dma_lkey`; `rxe_mr_copy()` short-circuits to `rxe_mr_copy_dma()` before `mr_check_range()`, memcpy\u0027ing from that raw kernel virtual address into the outbound packet with no bounds check. Arbitrary kernel memory is therefore transmitted to the unauthenticated remote peer.\\nI:H - The RDMA device is handed a work-request descriptor built entirely from out-of-lifetime memory, and the corrupted rkey response it produces is stored unvalidated by the peer (`clt_path-\u003erbufs[buf_id].rkey = le32_to_cpu(msg-\u003erkey)`), so subsequent server-to-client RDMA writes target an attacker-unintended memory region. Combined with the unchecked DMA-MR access primitive this is treated as a high integrity impact.\\nA:H - The reported and reproduced consequence is a kernel page fault oops (`BUG: kernel NULL pointer dereference` in `rxe_mr_copy`/`memcpy_orig` from the `rxe_sender` workqueue), and failed posts additionally drive `close_path()`, tearing down the storage session. This is remotely and repeatedly triggerable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"7eaa71f56a6f7ab87957213472dc6d4055862722\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"143378075904e78b3b2a810099bcc3b3d82d762f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"32e1e748a85bd52b20b3857d80fd166d22fa455a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"b238f61cc394d5fef27b26d7d9aa383ebfddabb0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"6ffb5c1885195ae5211a12b4acd2d51843ca41b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9cb837480424e78ed585376f944088246685aec3\", \"lessThan\": \"fb514b31395946022f13a08e06a435f53cf9e8b3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/ulp/rtrs/rtrs-srv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.233\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.176\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/ulp/rtrs/rtrs-srv.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7eaa71f56a6f7ab87957213472dc6d4055862722\"}, {\"url\": \"https://git.kernel.org/stable/c/143378075904e78b3b2a810099bcc3b3d82d762f\"}, {\"url\": \"https://git.kernel.org/stable/c/32e1e748a85bd52b20b3857d80fd166d22fa455a\"}, {\"url\": \"https://git.kernel.org/stable/c/b238f61cc394d5fef27b26d7d9aa383ebfddabb0\"}, {\"url\": \"https://git.kernel.org/stable/c/6ffb5c1885195ae5211a12b4acd2d51843ca41b0\"}, {\"url\": \"https://git.kernel.org/stable/c/fb514b31395946022f13a08e06a435f53cf9e8b3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/rtrs: Ensure \u0027ib_sge list\u0027 is accessible\\n\\nMove the declaration of the \u0027ib_sge list\u0027 variable outside the\\n\u0027always_invalidate\u0027 block to ensure it remains accessible for use\\nthroughout the function.\\n\\nPreviously, \u0027ib_sge list\u0027 was declared within the \u0027always_invalidate\u0027\\nblock, limiting its accessibility, then caused a\\n\u0027BUG: kernel NULL pointer dereference\u0027[1].\\n ? __die_body.cold+0x19/0x27\\n ? page_fault_oops+0x15a/0x2d0\\n ? search_module_extables+0x19/0x60\\n ? search_bpf_extables+0x5f/0x80\\n ? exc_page_fault+0x7e/0x180\\n ? asm_exc_page_fault+0x26/0x30\\n ? memcpy_orig+0xd5/0x140\\n rxe_mr_copy+0x1c3/0x200 [rdma_rxe]\\n ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe]\\n copy_data+0xa5/0x230 [rdma_rxe]\\n rxe_requester+0xd9b/0xf70 [rdma_rxe]\\n ? finish_task_switch.isra.0+0x99/0x2e0\\n rxe_sender+0x13/0x40 [rdma_rxe]\\n do_task+0x68/0x1e0 [rdma_rxe]\\n process_one_work+0x177/0x330\\n worker_thread+0x252/0x390\\n ? __pfx_worker_thread+0x10/0x10\\n\\nThis change ensures the variable is available for subsequent operations\\nthat require it.\\n\\n[1] https://lore.kernel.org/linux-rdma/6a1f3e8f-deb0-49f9-bc69-a9b03ecfcda7@fujitsu.com/\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.233\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.176\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.124\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.9\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:45.783Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36476\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:45.783Z\", \"dateReserved\": \"2025-01-15T13:08:59.730Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:10:20.507Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.