CVE-2024-36946

What it actually does

Insufficient skb allocation in rtm_phonet_notify() allows overflow when storing rtmsg, RTA_DST (u8), and RTA_OIF (u32) structures via fill_route().

Why it matters to the business

Kernel instability or potential privilege escalation on Linux systems using the Phonet protocol, increasing risk of service disruption or compromise in affected environments.

How an attack unfolds

An attacker with local access crafts network route operations that invoke rtm_phonet_notify(), causing the undersized skb to be written beyond its allocated bounds during netlink message construction.

How to fix it

Update the Linux kernel to the fixed commit ec1f71c05caeba0f814df77e0f511d8b4618623a or later stable releases containing the corrected NLMSG_ALIGN and nla_total_size calculations.

How to confirm the fix worked

Verify kernel source contains the corrected skb allocation sizes in rtm_phonet_notify() and test route notification paths for proper netlink message sizing.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel with Phonet enabled.
2. Trigger phonet route notification paths through socket or netlink operations.
3. Supply crafted route data that exceeds the undersized allocation for rtmsg + attributes.
4. Cause memory corruption leading to crash or code execution.

How to detect it

Review kernel logs for skb allocation failures or corruption warnings in phonet/netlink paths; examine netlink message traces for oversized route notifications.

What your security team should do

• Prioritize kernel updates on all systems using Phonet or netlink route notifications.
• Monitor for kernel oops or crashes related to phonet or netlink skb handling.
• Apply updates within standard patch cycles given low EPSS and no known exploitation.