CVE-2024-36010

What it actually does

Potential NULL pointer from kasprintf failure or string truncation in igb_set_fw_version firmware version formatting within the Linux kernel igb Ethernet driver.

Why it matters to the business

May cause network interface instability or crashes on systems using affected Intel igb hardware, increasing downtime risk until kernels are updated; widespread in Linux distributions and embedded devices.

How an attack unfolds

An attacker with local access triggers igb driver initialization or version reporting under memory pressure to hit kasprintf NULL return or truncated output, potentially leading to crashes or undefined behavior in the network stack.

How to fix it

Update Linux kernel to commits e8f897f4afef0031fe618a8e94127a0934896aba or c56d055893cbe97848611855d1c97d0ab171eccc (or later stable releases) that enlarge fw_version buffer and safely use snprintf.

How to confirm the fix worked

Verify kernel git commit or version string contains the fix; recompile with -Wformat-truncation and confirm no warnings in igb_main.c; test driver load under low-memory conditions.

Typical attack path

1. Gain local access to target system
2. Load or interact with igb network driver
3. Induce allocation failure during fw_version string handling
4. Trigger kernel panic or driver malfunction

How to detect it

Review kernel logs for igb driver load errors or NULL allocation warnings around version string formatting; inspect dmesg or syslog for igb_main.c references.

What your security team should do

• Prioritize kernel upgrades on systems with igb hardware within 30 days
• Monitor for related driver updates in distributions
• Apply compensating controls such as memory limits if patching is delayed