Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-36476
CVE-2024-36476:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2024-36476 affects the Linux kernel's RDMA/rtrs subsystem. The vulnerability was discovered in January 2025 and involves an accessibility issue with the 'ib_sge list' variable in the RDMA/rtrs server functionality. The issue affects various Linux distributions including Ubuntu 24.04 LTS, 22.04 LTS, and multiple kernel versions (Ubuntu Security).
Technical details
The vulnerability stems from a variable scope issue where the 'ibsge list' variable was incorrectly declared within an 'alwaysinvalidate' block, limiting its accessibility throughout the function. This implementation error could lead to a kernel NULL pointer dereference, as evidenced by the stack trace in the kernel logs. The issue was traced back to the original RDMA/rtrs server functionality implementation (Kernel Commit).
Impact
When triggered, the vulnerability results in a kernel NULL pointer dereference, which can cause system crashes and potential denial of service conditions. The issue specifically affects systems utilizing the RDMA/rtrs subsystem in the Linux kernel (Ubuntu Security).
Mitigation and workarounds
The issue has been fixed by moving the declaration of the 'ibsge list' variable outside the 'alwaysinvalidate' block, ensuring it remains accessible throughout the function. This fix has been implemented in various kernel versions and is being distributed through distribution-specific updates (Ubuntu Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management