CVE-2024-36288

SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

MEDIUM

5.5

CVSS Score

Published: June 21, 2024 at 11:18 AM UTC

Updated: October 15, 2026 at 01:18 AM UTC

7 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFPRUGGEDCOM RST2428P Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 6.9.44420b73c7f26fd5fcb37bbce5313dd356ef1b3ca6.10.0 6.10.0 rc1 6.8.12 6.9.38ca148915670a2921afcc255af9e1dc80f37b052a3c1afd5d7ad59e34a275d80c428952f83c8c1f0ab8466d4e26806a4ae82c282762c4545eecf45efbafa6b4d95d97877baa61883ff90f7e374427faec1d8c429e4d2ce85ec5c92cf71cb419baf75c56ff148a95f68c66c1b097391b68e153d5a46f0e780fe0b474974fee7af1df286e0edd5a1460c811865

Vendor states this is fixed in 0a1cb0c6102bb4fd310243588d39461da49497ad (fixed)

Vendor states this is fixed in 4a77c3dead97339478c7422eb07bf4bf63577008 (fixed)

Vendor states this is fixed in 4cefcd0af7458bdeff56a9d8dfc6868ce23d128a (fixed)

Vendor states this is fixed in 57ff6c0a175930856213b2aa39f8c845a53e5b1c (fixed)

Vendor states this is fixed in 6ed45d20d30005bed94c8c527ce51d5ad8121018 (fixed)

Vendor states this is fixed in af628d43a822b78ad8d4a58d8259f8bf8bc71115 (fixed)

Vendor states this is fixed in b4878ea99f2b40ef1925720b1b4ca7f4af1ba785 (fixed)

Affected range stops below 6.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.9.4, so it looks safe — our inference, not a vendor statement

RUGGEDCOM RST2428P Firmware · Siemens

60%

v < V3.1

Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement

SCALANCE XCH-300 · Siemens

60%

v < V3.1

Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement

SCALANCE XCM-300 · Siemens

60%

v < V3.1

Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement

SCALANCE XRH-300 · Siemens

60%

v < V3.1

Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement

SCALANCE XRM-300 · Siemens

60%

v < V3.1

Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement

SIMATIC S7-1500 TM MFP · Siemens

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references