Security readout for executives and security teams
Plain-English summary
CVE-2024-36270 is a Linux kernel netfilter TPROXY flaw where a missing null check can crash kernel code when IP is disabled on a device. Business impact is most relevant for Linux systems that use firewalling, routing, proxying, or appliance networking features.
Executive priority
Prioritize assessment for Linux network infrastructure and appliances because kernel faults can affect availability. Urgency is below known-exploited issues unless vendor guidance identifies exposed products or critical operational dependency.
Technical view
The issue is in nf_tproxy_laddr4 within IPv4 netfilter TPROXY handling. The CVE states __in_dev_get_rcu() can return NULL, causing a KASAN-reported null pointer dereference and general protection fault. Kernel stable commits add the required bail-out behavior.
Likely exposure
Exposure is likely limited to Linux systems using netfilter/nftables TPROXY paths, especially networking appliances, gateways, or embedded products. The source bundle lists Linux as affected and includes Siemens advisories, but it does not provide a complete product exposure matrix.
Exploitation context
The provided sources do not show CISA KEV listing, public exploitation, exploit maturity, or attack prerequisites. Treat this as a kernel stability and availability risk until vendor advisories clarify practical exploitability in your environment.
Researcher notes
Primary evidence is a kernel syzbot crash trace and the upstream fix rationale: __in_dev_get_rcu() may return NULL. The bundle lacks CVSS, CWE, exploitability details, and distribution-specific fixed package versions, so avoid over-scoping beyond TPROXY-related Linux exposure.
Mitigation direction
- Update affected Linux kernels using vendor-supported packages containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes before relying on upstream version numbers.
- Review Siemens SSA-265688 and SSA-613116 if using Siemens affected products.
- Prioritize systems performing routing, firewalling, transparent proxying, or appliance networking roles.
- Track vendor guidance where no product-specific fix is named in the source bundle.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, containers hosts, and embedded systems.
- Confirm whether netfilter or nftables TPROXY functionality is configured or required.
- Verify installed kernels include the relevant upstream stable commit or vendor backport.
- Check whether interfaces can operate with IP disabled in affected traffic paths.
- Document Siemens product applicability against the two referenced Siemens advisories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36270 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/10f0af5234dafd03d2b75233428ec3f11cf7e43dCVE reference, Linux
- https://git.kernel.org/stable/c/07eeedafc59c45fe5de43958128542be3784764cCVE reference, Linux
- https://git.kernel.org/stable/c/6fe5af4ff06db3d4d80e07a19356640428159f03CVE reference, Linux
- https://git.kernel.org/stable/c/caf3a8afb5ea00db6d5398adf148d5534615fd80CVE reference, Linux
- https://git.kernel.org/stable/c/570b4c52096e62fda562448f5760fd0ff06110f0CVE reference, Linux
- https://git.kernel.org/stable/c/819bfeca16eb9ad647ddcae25e7e12c30612147cCVE reference, Linux
- https://git.kernel.org/stable/c/21a673bddc8fd4873c370caf9ae70ffc6d47e8d3CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-613116.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.