CVE-2024-36270

What it actually does

Null pointer dereference in nf_tproxy_laddr4 when __in_dev_get_rcu returns NULL on a device with IP disabled, leading to a general protection fault during nft_tproxy evaluation.

Why it matters to the business

Local denial of service via kernel crash on systems running affected Linux kernels; low exploitation likelihood but high impact if triggered in production network stacks.

How an attack unfolds

An attacker with local access crafts nftables rules using tproxy that are evaluated on an interface without IPv4 configured, causing the kernel to dereference a null pointer during address lookup and crash the system.

How to fix it

Upgrade the Linux kernel to the fixed commit 10f0af5234dafd03d2b75233428ec3f11cf7e43d or later stable releases containing the patch; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Verify kernel source contains the null check for __in_dev_get_rcu before the dereference in nf_tproxy_laddr4; confirm running kernel version includes the fix commit; test nft tproxy rules on interfaces without IP configuration.

Typical attack path

1. Obtain local access or execute code on target Linux system
2. Load or modify nftables rules to invoke nft_tproxy_eval_v4
3. Trigger evaluation on a network device where IP has been disabled
4. Cause kernel fault in nf_tproxy_laddr4 leading to panic or reboot

How to detect it

Review kernel logs for general protection faults or KASAN null-ptr-deref reports mentioning nf_tproxy_laddr4 or nft_tproxy_eval; correlate with nftables rule changes or interface IP configuration events.

What your security team should do

• Prioritize kernel upgrade on all exposed or multi-tenant Linux systems within maintenance windows
• Monitor for local privilege or container escape attempts that could reach this code path
• Apply compensating controls such as restricting unprivileged nftables usage until patched