CVE-2024-36883

What it actually does

Race condition in net_alloc_generic allows concurrent increment of max_gen_ptrs under pernet_ops_rwsem to produce an s.len value larger than the previously allocated array, enabling subsequent out-of-bounds read/write through net_assign_generic.

Why it matters to the business

Unpatched Linux systems face elevated risk of local privilege escalation or denial of service from network namespace operations, increasing exposure in high-density container and virtualization environments.

How an attack unfolds

An attacker with local code execution triggers rapid pernet ops registration while net_alloc_generic runs, causing the double-read of max_gen_ptrs to allocate a smaller array than later used for bounds checking, resulting in memory corruption.

How to fix it

Upgrade the Linux kernel to the commit c16fa4f2ad19908a47c63d8fa436a1178438c7e7 or later; rebuild and reboot all affected systems; prioritize kernels used in container hosts and network namespaces.

How to confirm the fix worked

Confirm the running kernel contains commit c16fa4f2ad19908a47c63d8fa436a1178438c7e7 via uname or kernel source; recompile with the fix and verify single read of max_gen_ptrs in net_alloc_generic.

Typical attack path

1. Obtain local execution on a Linux host
2. Race net_alloc against pernet_ops registration to enlarge max_gen_ptrs
3. Trigger net_assign_generic on the undersized array
4. Achieve out-of-bounds read or write for privilege escalation or crash

How to detect it

Review kernel logs and audit trails for repeated pernet ops registration coinciding with net_alloc failures or oops in ops_init; correlate with process creation near network namespace setup.

What your security team should do

• Apply the fixed kernel commit immediately on internet-facing and multi-tenant hosts
• Scan build pipelines for older kernel versions and enforce the updated commit
• Monitor for local privilege-escalation attempts targeting network namespace code
• Test container runtime stability after kernel upgrade