CVE-2024-36972 is a high-severity vulnerability in the Linux kernel affecting the AF_UNIX socket implementation. The flaw arises from a race condition between the __unix_gc() garbage collection function and the queue_oob() function that handles out-of-band (OOB) data on UNIX domain sockets. Specifically, __unix_gc() attempts to clean up closed inflight sockets and, if the socket has MSG_OOB data referenced by unix_sk(sk)->oob_skb, it drops the reference and sets this pointer to NULL without proper locking. Concurrently, the peer socket can send MSG_OOB messages, and queue_oob() may update unix_sk(sk)->oob_skb simultaneously. This lack of synchronization leads to a NULL pointer dereference in kernel space, causing a kernel crash (kernel oops) and potential denial of service. The issue was reported by Billy Jheng Bing-Jhong and fixed by updating unix_sk(sk)->oob_skb under the sk_receive_queue lock to ensure proper synchronization. The patch also defers kfree_skb() calls in manage_oob() to avoid lock dependency false positives. The vulnerability affects multiple Linux kernel versions as identified by specific commit hashes. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, requiring low privileges but no user interaction. Exploitation results in kernel NULL pointer dereference, leading to system instability or crash, which could be leveraged for denial of service or potentially privilege escalation if combined with other vulnerabilities. No known exploits in the wild have been reported yet.

For European organizations, this vulnerability poses a significant risk to systems running vulnerable Linux kernel versions, especially servers and infrastructure relying on UNIX domain sockets for inter-process communication. The kernel crash caused by the NULL pointer dereference can lead to denial of service, disrupting critical services and applications. In environments where Linux is used extensively, such as cloud providers, data centers, telecommunications, and industrial control systems, this could result in operational downtime and potential data loss. The high impact on confidentiality, integrity, and availability means that sensitive data and system stability could be compromised. Given the widespread use of Linux in European enterprises and public sector infrastructure, unpatched systems could be targeted by attackers to disrupt services or as part of multi-stage attacks. Although no exploits are currently known in the wild, the vulnerability's nature and severity warrant immediate attention to prevent potential exploitation.

European organizations should prioritize patching affected Linux kernel versions as soon as vendor updates are available. Until patches are applied, organizations should: 1) Restrict network access to systems running vulnerable kernels, especially limiting untrusted users from accessing services that utilize UNIX domain sockets. 2) Monitor kernel logs and system stability for signs of crashes or oops events related to socket handling. 3) Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and Control Flow Integrity (CFI) to reduce exploitation risk. 4) Use containerization or sandboxing to isolate critical services that use UNIX sockets, limiting impact scope. 5) Implement strict privilege separation and minimize processes with the ability to create or interact with UNIX domain sockets. 6) Conduct thorough testing of kernel updates in staging environments to ensure compatibility and stability before deployment. 7) Maintain up-to-date intrusion detection systems tuned to detect anomalies in kernel behavior or socket communication patterns. These steps go beyond generic advice by focusing on access control, monitoring, and isolation specific to the vulnerability's mechanism.