CVE-2024-36935

What it actually does

The vulnerability occurs when a count-sized kernel buffer is populated via memdup_user without ensuring NUL termination; subsequent sscanf on the buffer can then perform an out-of-bounds read past the allocated memory.

Why it matters to the business

Potential kernel memory disclosure or system instability on affected Linux deployments; low public exploitability reduces immediate ransomware or mass-exploitation risk, but still requires timely patching in high-prevalence environments.

How an attack unfolds

An attacker supplies a userspace buffer lacking a terminating NUL byte to the affected nice interface, triggering the copy into kernel memory; sscanf then reads past the intended buffer boundary, enabling information leakage or crash. No named threat actors have been observed exploiting this specific issue.

How to fix it

Upgrade clickhouse/clickhouse (GIT) to commit 4a08f8a073b757f5e7075d960a43f8709f9abd40 or later; rebuild and redeploy the kernel module or distribution package containing the fix. Apply the change across all downstream dependents.

How to confirm the fix worked

Confirm the source contains memdup_user_nul instead of memdup_user in the nice buffer handling path; verify the updated commit hash is present in the running kernel tree and test the interface with a non-terminated buffer to ensure no OOB access occurs.

Typical attack path

1. Locate the vulnerable nice sysfs or proc interface
2. Craft a userspace buffer of the exact count size without a trailing NUL
3. Invoke the interface to trigger memdup_user followed by sscanf
4. Observe OOB read behavior for memory disclosure or denial of service

How to detect it

Review kernel audit logs and dmesg for sscanf-related faults or OOB access warnings around the nice subsystem; correlate with process activity invoking the affected interface. No public exploitation artifacts have been reported.

What your security team should do

• Prioritize upgrade to the listed fixed commit in all Linux kernel builds within 30 days
• Audit custom or downstream kernels for the same memdup_user pattern
• Monitor EPSS and KEV status for any future increase in exploit maturity