CVE-2024-36964

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-36964", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.081Z", "datePublished": "2024-06-03T07:50:01.987Z", "dateUpdated": "2026-08-05T11:32:18.997Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:18.997Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The malicious `perm` word is parsed straight out of an Rstat response from the 9P peer, and v9fs supports `trans=tcp` (port 564) as well as rdma/xen, so the attacker is a remote or spoofed file server across a network. No local access to the client is needed to deliver the crafted metadata.\nAC:L - The server simply sets bit 0x800 in the stat `perm` field \u2014 fully deterministic, no race or memory-layout dependency. It also controls the only other precondition, since `p9_client_version()` lets the server downgrade the session to plain 9P2000 by answering \"9P2000\" to a \"9P2000.L\" TVERSION.\nPR:N - v9fs calls `p9_client_attach()` with `afid = NULL`, so no 9P authentication is performed, and the transport is plaintext \u2014 the attacker holds no credentials or privileges on the client system. The client blindly trusts the mode bits of whatever peer answers.\nUI:R - The forged setuid bit is applied to the inode with no user action, but the privilege gain is realized only when a local process executes the planted binary from the mount. That execution is performed by a party other than the remote attacker.\nS:U - The impact is confined to the client system's own user/privilege model \u2014 standard privilege escalation within one security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Execution of the forged setuid binary yields the mount's `dfltuid`, which is commonly configured as 0 for legacy 9P2000 mounts, giving read access to all files on the system. Forged setgid/sticky bits likewise subvert the client's access-control decisions in `generic_permission()`.\nI:H - Beyond directly corrupting inode permission metadata, the resulting setuid-`dfltuid` (typically root) execution allows arbitrary modification of system files and state. v9fs never sets `SB_NOSUID` and cannot be mounted from a user namespace, so `bprm_fill_uid()` honors the bit.\nA:H - With execution as `dfltuid=0` obtained through the forged setuid bit, the attacker attains full control of the client and can halt or crash the system at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/9p/vfs_inode.c"], "versions": [{"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "e90bc596a74bb905e0a45bf346038c3f9d1e868d", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "df1962a199783ecd66734d563caf0fedecf08f96", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "5a605930e19f451294bd838754f7d66c976a8a2c", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "ad4f65328661392de74e3608bb736fedf3b67e32", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "ca9b5c81f0c918c63d73d962ed8a8e231f840bc8", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "e55c601af3b1223a84f9f27f9cdbd2af5e203bf3", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "157d468e34fdd3cb1ddc07c2be32fb3b02826b02", "status": "affected", "versionType": "git"}, {"version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "cd25e15e57e68a6b18dc9323047fe9c68b99290b", "status": "affected", "versionType": "git"}, {"version": "29a3e8657d2a2640384166e3fe29a086d235fc33", "status": "affected", "versionType": "git"}, {"version": "3.0.5", "lessThan": "3.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/9p/vfs_inode.c"], "versions": [{"version": "3.1", "status": "affected"}, {"version": "0", "lessThan": "3.1", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.314", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.276", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.217", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.159", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "4.19.314"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.4.276"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.10.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "5.15.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.1.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.6.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.8.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d"}, {"url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96"}, {"url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c"}, {"url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32"}, {"url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8"}, {"url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3"}, {"url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02"}, {"url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b"}], "title": "fs/9p: only translate RWX permissions for plain 9P2000", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-21T18:11:48.356880Z", "id": "CVE-2024-36964", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T18:11:56.154Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.532Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.532Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-21T18:11:48.356880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T18:11:52.528Z"}}], "cna": {"title": "fs/9p: only translate RWX permissions for plain 9P2000", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "e90bc596a74bb905e0a45bf346038c3f9d1e868d", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "df1962a199783ecd66734d563caf0fedecf08f96", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "5a605930e19f451294bd838754f7d66c976a8a2c", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "ad4f65328661392de74e3608bb736fedf3b67e32", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "ca9b5c81f0c918c63d73d962ed8a8e231f840bc8", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "e55c601af3b1223a84f9f27f9cdbd2af5e203bf3", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "157d468e34fdd3cb1ddc07c2be32fb3b02826b02", "versionType": "git"}, {"status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "lessThan": "cd25e15e57e68a6b18dc9323047fe9c68b99290b", "versionType": "git"}, {"status": "affected", "version": "29a3e8657d2a2640384166e3fe29a086d235fc33", "versionType": "git"}, {"status": "affected", "version": "3.0.5", "lessThan": "3.1", "versionType": "semver"}], "programFiles": ["fs/9p/vfs_inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"status": "unaffected", "version": "0", "lessThan": "3.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.314", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.276", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.217", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.159", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.91", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.31", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/9p/vfs_inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d"}, {"url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96"}, {"url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c"}, {"url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32"}, {"url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8"}, {"url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3"}, {"url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02"}, {"url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.314", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.276", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.217", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.159", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.91", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.31", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.10", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.0.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:48:04.099Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36964", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:48:04.099Z", "dateReserved": "2024-05-30T15:25:07.081Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-03T07:50:01.987Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/9p/vfs_inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e90bc596a74bb905e0a45bf346038c3f9d1e868d", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "df1962a199783ecd66734d563caf0fedecf08f96", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "5a605930e19f451294bd838754f7d66c976a8a2c", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "ad4f65328661392de74e3608bb736fedf3b67e32", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "ca9b5c81f0c918c63d73d962ed8a8e231f840bc8", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "e55c601af3b1223a84f9f27f9cdbd2af5e203bf3", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "157d468e34fdd3cb1ddc07c2be32fb3b02826b02", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"lessThan": "cd25e15e57e68a6b18dc9323047fe9c68b99290b", "status": "affected", "version": "45089142b1497dab2327d60f6c71c40766fc3ea4", "versionType": "git"}, {"status": "affected", "version": "29a3e8657d2a2640384166e3fe29a086d235fc33", "versionType": "git"}, {"lessThan": "3.1", "status": "affected", "version": "3.0.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/9p/vfs_inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.1"}, {"lessThan": "3.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.314", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.276", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.217", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.159", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.91", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.31", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1350A539-B5DC-4612-9B61-E5516FD777D5", "versionEndExcluding": "4.19.314", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "126C6EEC-8874-4233-AE09-634924FCDDF4", "versionEndExcluding": "5.4.276", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC67C71C-2044-40BA-B590-61E562F69F89", "versionEndExcluding": "5.10.217", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F16678CD-F7C6-4BF6-ABA8-E7600857197B", "versionEndExcluding": "5.15.159", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F8C886C-75AA-469B-A6A9-12BF1A29C0D5", "versionEndExcluding": "6.1.91", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00", "versionEndExcluding": "6.6.31", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3", "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/9p: solo traduce permisos RWX para 9P2000 simple. Se permite el paso de basura en bits permanentes de 9P2000 simple, lo que hace que pueda establecer (entre otros) el bit suid. Probablemente esta no era la intenci\u00f3n, ya que los bits extendidos de Unix se manejan expl\u00edcita y condicionalmente en .u."}], "id": "CVE-2024-36964", "lastModified": "2026-08-04T11:18:35.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36964", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-21T18:11:48.356880Z", "version": "2.0.3"}}]}, "published": "2024-06-03T08:15:09.903", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: fs/9p: only translate RWX permissions for plain 9P2000", "id": "2290404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2290404"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs/9p: only translate RWX permissions for plain 9P2000\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u."], "name": "CVE-2024-36964", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36964\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36964\nhttps://lore.kernel.org/linux-cve-announce/2024060345-CVE-2024-36964-d557@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T15:42:31.872125+00:00", "updated": "2025-07-12T15:42:31.872170+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}