CVE-2024-36476

What it actually does

Declaration of 'ib_sge list' inside the 'always_invalidate' block caused the variable to be inaccessible later in the RDMA/rtrs function, resulting in a kernel NULL pointer dereference during memcpy and RDMA operations such as rxe_mr_copy and copy_data.

Why it matters to the business

Unexpected kernel crashes on Linux systems using RDMA can interrupt high-performance networking, storage, and compute workloads, leading to downtime and potential data loss in affected environments; low exploit probability reduces immediate risk but stability issues persist until patched.

How an attack unfolds

An attacker triggers RDMA/rtrs code paths that exercise the always_invalidate block and subsequent operations, causing the uninitialized or out-of-scope pointer to be dereferenced and resulting in a page fault; threat actors have been observed exploiting similar Linux kernel memory issues in espionage and financially motivated campaigns.

How to fix it

Update to fixed kernel versions containing commit 7eaa71f56a6f7ab87957213472dc6d4055862722 or apply the corresponding Ubuntu package updates (nvidia-graphics-drivers-375 375.66-0ubuntu0.14.04.1 or 375.66-0ubuntu0.16.04.1) on affected releases.

How to confirm the fix worked

Verify the running kernel contains the fix commit, reproduce RDMA workloads that previously triggered the dereference, and confirm absence of NULL pointer oops in dmesg or kernel logs after upgrade.

Typical attack path

1. Identify systems exposing RDMA/rtrs interfaces
2. Craft input or workload that enters the always_invalidate code path
3. Force execution of later function code that references the inaccessible ib_sge list variable
4. Trigger NULL pointer dereference leading to kernel oops and potential denial of service

How to detect it

Search kernel logs and dmesg for NULL pointer dereference oops containing stack traces with rxe_mr_copy, copy_data, rxe_requester, and rdma_rxe symbols; correlate with RDMA activity timestamps.

• BUG: kernel NULL pointer dereference
• rxe_mr_copy+0x1c3/0x200 [rdma_rxe]
• copy_data+0xa5/0x230 [rdma_rxe]
• rxe_requester+0xd9b/0xf70 [rdma_rxe]
• asm_exc_page_fault

What your security team should do

• Prioritize kernel upgrades on all systems using RDMA/rtrs
• Monitor kernel logs for RDMA-related page faults until patches are deployed
• Restrict RDMA access to trusted networks where feasible
• Test patched kernels in staging environments before production rollout