Security readout for executives and security teams
Plain-English summary
This is a Linux kernel bug where a key’s expiration can be overwritten during creation, making it effectively permanent. The cited description highlights DNS-resolution impact because stale key data may stop expected DNS updates. The CVE carries a critical CVSS score, but the provided sources do not show active exploitation.
Executive priority
Prioritize patching through normal critical kernel maintenance, especially on internet-exposed or production Linux systems. The score is severe, but available sources emphasize correctness and DNS update impact rather than confirmed attacks. Use vendor kernel updates and reboot planning to reduce risk cleanly.
Technical view
The kernel keys subsystem unconditionally reset expiry during key instantiation, defaulting to TIME64_MAX. The fix restores conditional expiry handling so key_set_expiry is called only when the preparser provides a specific expiry. Evidence names Linux kernel versions and multiple stable-branch commits, plus a Debian LTS advisory.
Likely exposure
Exposure is likely on Linux systems running affected kernel builds or distro kernels missing the referenced stable fixes. Systems using kernel keyrings for DNS resolver behavior may see operational impact. Confirm exposure through the vendor’s patched package status, because distro backports can differ from upstream version numbers.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The CVSS vector is network, low-complexity, and unauthenticated, but the bundle does not document a practical exploit path. Treat exploit status as unconfirmed, not proven active.
Researcher notes
The evidence is strongest for root cause and fix location, not exploitation. The CWE-324 mapping appears broad relative to the described key-expiry logic. Validate affectedness carefully across stable branches and distribution backports, and avoid assuming exploitability beyond the supplied CVSS metadata.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Apply the relevant Debian LTS kernel update where applicable.
- For custom kernels, review and incorporate the upstream stable fix through normal kernel maintenance.
- Reboot into the patched kernel after installation.
- Monitor Linux and distribution advisories for corrected affected-version guidance.
Validation and detection
- Inventory running Linux kernel versions and distro package release levels.
- Compare installed kernels with vendor advisories, not only upstream version strings.
- Verify the stable fix is present in custom kernel source trees.
- Confirm affected systems have rebooted into the patched kernel.
- Check DNS-resolution behavior where key expiration affects operational reliability.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit ad2011ea787928b2accb5134f1e423b11fe80a8a
- Linux stable commit ed79b93f725cd0da39a265dc23d77add1527b9be
- Linux stable commit e4519a016650e952ad9eb27937f8c447d5a4e06d
- Linux stable commit 25777f3f4e1f371d16a594925f31e37ce07b6ec7
- Linux stable commit 939a08bcd4334bad4b201e60bd0ae1f278d71d41
- Linux stable commit cc219cb8afbc40ec100c0de941047bb29373126a
- Linux stable commit 9da27fb65a14c18efd4473e2e82b76b53ba60252
- Debian LTS announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-324: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36031 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ad2011ea787928b2accb5134f1e423b11fe80a8aCVE reference, Linux
- https://git.kernel.org/stable/c/ed79b93f725cd0da39a265dc23d77add1527b9beCVE reference, Linux
- https://git.kernel.org/stable/c/e4519a016650e952ad9eb27937f8c447d5a4e06dCVE reference, Linux
- https://git.kernel.org/stable/c/25777f3f4e1f371d16a594925f31e37ce07b6ec7CVE reference, Linux
- https://git.kernel.org/stable/c/939a08bcd4334bad4b201e60bd0ae1f278d71d41CVE reference, Linux
- https://git.kernel.org/stable/c/cc219cb8afbc40ec100c0de941047bb29373126aCVE reference, Linux
- https://git.kernel.org/stable/c/9da27fb65a14c18efd4473e2e82b76b53ba60252CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of a Key Past its Expiration Date
Use of a Key Past its Expiration Date represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.