CVE-2024-47743

What it actually does

NULL pointer dereference in find_asymmetric_key() when all id_0, id_1, and id_2 arguments are NULL, causing WARN followed by kernel oops on id_2 dereference.

Why it matters to the business

Kernel crashes or denial of service can disrupt systems relying on asymmetric key operations, increasing downtime and operational risk especially in environments with high Linux kernel prevalence.

How an attack unfolds

An attacker invokes find_asymmetric_key() passing NULL for all identifier arguments; the missing id_2 check allows dereference after the initial WARN, leading to oops. Threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel memory issues.

How to fix it

Update to a Linux kernel version containing the fix that adds the missing id_2 check and relocates WARN_ON() to the final else branch. Apply vendor-supplied kernel updates promptly given the published date and ongoing kernel memory corruption exposures.

How to confirm the fix worked

Confirm the patch is present by reviewing the find_asymmetric_key() implementation for the added id_2 NULL check and relocated WARN_ON(); test with NULL identifier inputs to verify no oops occurs.

Typical attack path

1. Identify code paths or user-space interfaces that call find_asymmetric_key() with key identifiers
2. Supply NULL values for id_0, id_1, and id_2 arguments
3. Trigger the function to hit the unchecked id_2 dereference
4. Cause kernel oops and potential system instability or crash

How to detect it

Inspect kernel logs for WARN messages followed by NULL pointer dereference oops in find_asymmetric_key(); correlate with processes performing asymmetric key operations. Check for exploitation patterns seen in Linux kernel memory issues by espionage actors.

• WARNING: at ... find_asymmetric_key
• BUG: unable to handle kernel NULL pointer dereference
• RIP: ... find_asymmetric_key

What your security team should do

• Prioritize kernel updates on all affected Linux systems due to memory corruption family and listed threat actor activity
• Monitor for kernel oops logs related to asymmetric key handling
• Review usage of asymmetric keys in cryptographic operations for exposure
• Apply fixes within standard patch windows given low EPSS but persistent kernel risk