CVE-2024-36489

What it actually does

Missing write memory barrier in tls_init allows store-store reordering so that ctx->sk_proto remains NULL when tls_setsockopt or tls_getsockopt dereferences it after sk_prot has been updated.

Why it matters to the business

Local users or processes using TLS sockets can trigger kernel NULL pointer dereferences, causing system crashes and loss of availability for any workloads relying on kernel TLS.

How an attack unfolds

An attacker with local access creates TLS sockets while the kernel is initializing the TLS protocol hooks; the missing barrier lets one CPU observe the updated sk_prot before the ctx structure is fully populated, resulting in a NULL dereference during setsockopt/getsockopt.

How to fix it

Upgrade the Linux kernel to a version containing commit d72e126e9a36d3d33889829df8fc90100bb0e071 which places rcu_assign_pointer after ctx->sk_proto initialization.

How to confirm the fix worked

Verify the running kernel contains commit d72e126e9a36d3d33889829df8fc90100bb0e071 or later equivalent stable backport; confirm tls_init uses rcu_assign_pointer after sk_proto assignment.

Typical attack path

1. Obtain local execution context on the target Linux system
2. Open sockets and enable TLS via setsockopt while tls_init runs concurrently
3. Trigger sock_common_setsockopt to invoke the TLS handler before ctx->sk_proto is visible
4. Cause NULL pointer dereference leading to kernel panic or oops

How to detect it

Inspect kernel logs for oops or panic entries containing tls_init, tls_ctx_create, or NULL dereference in setsockopt paths; correlate with processes performing TLS socket operations around the time of the crash.

• NULL dereference at ctx->sk_proto->setsockopt
• Oops in tls_setsockopt or tls_getsockopt
• sk_prot update visible before ctx initialization in tls_init

What your security team should do

• Apply the referenced kernel commit or latest stable update to all affected systems
• Prioritize patching on multi-tenant or high-availability hosts where local users may exist
• Monitor for kernel oops reports referencing tls_ctx or sk_proto NULL dereferences