CVE-2024-35896

CVE-2024-35896 is a vulnerability in the Linux kernel's Netfilter component, where the setsockopt function fails to properly validate the length of user-supplied data before copying it into kernel space. This oversight can lead to out-of-bounds memory access, potentially causing system crashes or allowing attackers to execute arbitrary code. The issue has been addressed by implementing appropriate checks on the optlen argument to ensure data is correctly sized before being processed. Users are advised to update their Linux kernel to a version that includes this fix to mitigate potential risks.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation is confined to local users and primarily leads to a system crash or potential memory disclosure rather than direct privilege escalation. Triggering the flaw requires local execution privileges to manipulate socket options processed by Netfilter, particularly under configurations involving cgroup BPF program filters. Because the issue cannot be triggered remotely over the network and requires specific local socket interactions, the risk to typical enterprise deployments remains limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.