CVE-2024-36964

What it actually does

The flaw permits garbage values in plain 9P2000 permission bits to pass through unchecked, allowing the suid bit (and other extended Unix bits) to be set even though those bits are intended to be handled only under explicit .u conditions.

Why it matters to the business

Systems exposing 9P2000 file systems may allow local or remote users to obtain unintended elevated privileges, increasing the chance of unauthorized code execution and data compromise on Linux hosts using this protocol.

How an attack unfolds

An attacker sends a crafted 9P2000 Tcreate or Twalk message containing permission bits with the suid bit set; because the kernel does not filter these bits for the plain 9P2000 variant, the file is created or opened with suid privileges, enabling subsequent privilege escalation.

How to fix it

Upgrade the Linux kernel to commit e90bc596a74bb905e0a45bf346038c3f9d1e868d or later; rebuild and reboot all affected systems. Where immediate patching is not possible, restrict 9P2000 mounts to trusted clients only.

How to confirm the fix worked

Confirm the running kernel contains commit e90bc596a74bb905e0a45bf346038c3f9d1e868d by inspecting /proc/version or the kernel build log; attempt to create a file via 9P2000 with suid bits and verify the bits are stripped.

Typical attack path

1. Identify a 9P2000 mount exported by the target kernel
2. Craft a Tcreate/Twalk request containing suid permission bits
3. Submit the request over the 9P connection
4. Receive a file descriptor or inode with suid bit applied
5. Execute the file to obtain elevated privileges

How to detect it

Review 9P server logs for Tcreate or Twalk requests carrying permission values with high bits set; correlate with subsequent file-creation events that result in suid binaries appearing in unexpected locations.

What your security team should do

• Prioritize patching all production kernels that serve 9P2000 within the next maintenance window
• Audit exposed 9P2000 shares and apply network segmentation or authentication where feasible
• Add the fixed commit hash to internal kernel build pipelines and CI checks