Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-36888

6.2 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix selection of wake_cpu in kick_pool() With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following kernel oo…

Published May 30, 2024CWE-476EPSS 0.24%

Overview

CVE-2024-36888 is a medium-severity vulnerability. It was published on May 30, 2024 and has a CVSS 3.1 base score of 6.2 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 6.2, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix selection of wake_cpu in kick_pool()

With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following

kernel oops was observed:

smp: Bringing up secondary CPUs ...

smp: Brought up 1 node, 8 CPUs

Unable to handle kernel pointer dereference in virtual kernel address space

Failing address: 0000000000000000 TEID: 0000000000000803

[..]

Call Trace:

arch_vcpu_is_preempted+0x12/0x80

select_idle_sibling+0x42/0x560

select_task_rq_fair+0x29a/0x3b0

try_to_wake_up+0x38e/0x6e0

kick_pool+0xa4/0x198

__queue_work.part.0+0x2bc/0x3a8

call_timer_fn+0x36/0x160

__run_timers+0x1e2/0x328

__run_timer_base+0x5a/0x88

run_timer_softirq+0x40/0x78

__do_softirq+0x118/0x388

irq_exit_rcu+0xc0/0xd8

do_ext_irq+0xae/0x168

ext_int_handler+0xbe/0xf0

psw_idle_exit+0x0/0xc

default_idle_call+0x3c/0x110

do_idle+0xd4/0x158

cpu_startup_entry+0x40/0x48

rest_init+0xc6/0xc8

start_kernel+0x3c4/0x5e0

startup_continue+0x3c/0x50

The crash is caused

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/57a01eafdcf78f6da34fad9ff075ed5dfdd9f420Refgit.kernel.org/stable/c/6d559e70b3eb6623935cbe7f94c1912c1099777bRefgit.kernel.org/stable/c/c57824d4fe07c2131f8c48687cbd5ee2be60c767Refgit.kernel.org/stable/c/57a01eafdcf78f6da34fad9ff075ed5dfdd9f420Refgit.kernel.org/stable/c/6d559e70b3eb6623935cbe7f94c1912c1099777bRefgit.kernel.org/stable/c/c57824d4fe07c2131f8c48687cbd5ee2be60c767

How CyberStrike helps

Frequently asked questions

What is CVE-2024-36888?

CVE-2024-36888 is a medium-severity vulnerability. It was published on May 30, 2024 and has a CVSS 3.1 base score of 6.2 (MEDIUM).

How severe is CVE-2024-36888?

This vulnerability has a CVSS 3.1 base score of 6.2, rated MEDIUM. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-36888?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-36888?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-36888 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999