CVE-2020-36691

What it actually does

The flaw permits unbounded recursion in lib/nlattr.c when processing a nested Netlink policy containing a back reference, leading to stack exhaustion and denial of service.

Why it matters to the business

Systems may experience unexpected crashes or resource exhaustion, disrupting services and requiring reboots or restarts on affected Linux deployments.

How an attack unfolds

An attacker with local access crafts a malicious Netlink message containing a nested policy with a back reference, triggering recursive processing in the kernel's attribute parser until resources are exhausted.

How to fix it

Update the Linux kernel to a version containing commit 7690aa1cdf7c4565ad6b013b324c28b685505e24 or later; systems running kernel 5.8 or newer are not affected.

How to confirm the fix worked

Verify the running kernel version is 5.8 or newer; confirm the presence of the fix commit in the source tree and test Netlink attribute handling with crafted nested policies.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Construct and send a specially crafted Netlink message with nested policy back references
3. Trigger the recursion in nlattr processing to exhaust kernel stack resources
4. Cause kernel panic or denial of service

How to detect it

Review kernel logs for stack overflow or recursion-related panics involving nlattr; examine audit logs for unusual Netlink activity from local processes.

What your security team should do

• Prioritize kernel upgrades to 5.8 or later across all Linux hosts
• Monitor for kernel oops or panic events related to Netlink processing
• Restrict untrusted local user access where possible until patches are applied