CVE-2024-36031

During the key instantiation process in the Linux kernel, the key_set_expiry function was called unconditionally, resulting in the expiration time being set to TIME64_MAX — essentially infinity. The correct behavior should be to call this function only when the pre-parser explicitly indicates a specific expiration time. As a result, the expiration time set by user-space was being overwritten with a default value, making the key permanent contrary to system intentions.

An attacker or unauthorized party can exploit the fact that keys never expire to maintain outdated or malicious data (e.g., DNS records) indefinitely, bypassing key refresh and invalidation mechanisms. This can lead to violations of system confidentiality, integrity, and availability (CVSS score 9.8).

Apply patches available from the manufacturer according to the references — fixes have been published in the stable Linux kernel repositories at the addresses indicated in the CVE references section.

Linux kernel — versions indicated in the manufacturer's references (patches available at the addresses in the references section).