CVE-2024-27394 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb
https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f
https://lore.kernel.org/linux-cve-announce/2024050836-CVE-2024-27394-4277@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-27394
https://www.cve.org/CVERecord?id=CVE-2024-27394

History

Fri, 06 Sep 2024 15:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-09T16:37:11.495Z

Updated: 2024-11-05T09:21:24.590Z

Reserved: 2024-02-25T13:47:42.677Z

Link: CVE-2024-27394

Vulnrichment

Updated: 2024-08-02T00:34:52.373Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T15:12:27.363

Modified: 2024-09-06T14:35:11.027

Link: CVE-2024-27394

Redhat

Severity : Moderate

Publid Date: 2024-05-08T00:00:00Z

Links: CVE-2024-27394 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27394", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:47:42.677Z", "datePublished": "2024-05-09T16:37:11.495Z", "dateUpdated": "2024-11-05T09:21:24.590Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:21:24.590Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix Use-After-Free in tcp_ao_connect_init\n\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\n\nTo prevent this, it should be changed to hlist_for_each_entry_safe."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ao.c"], "versions": [{"version": "7c2ffaf21bd6", "lessThan": "ca4fb6c6764b", "status": "affected", "versionType": "git"}, {"version": "7c2ffaf21bd6", "lessThan": "80e679b352c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ao.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.9", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f"}, {"url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb"}], "title": "tcp: Fix Use-After-Free in tcp_ao_connect_init", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "6.7", "status": "affected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "7c2ffaf21bd6", "status": "affected", "lessThan": "ca4fb6c6764b", "versionType": "git"}, {"version": "7c2ffaf21bd6", "status": "affected", "lessThan": "80e679b352c3", "versionType": "git"}, {"version": "0", "status": "unaffected", "lessThan": "6.7", "versionType": "git"}, {"version": "6.8.9", "status": "unaffected", "lessThan": "6.9", "versionType": "git"}, {"version": "6.9", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-04T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-27394"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T03:55:12.169Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.373Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.373Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27394", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-05T03:56:15.841644Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "6.7"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "7c2ffaf21bd6", "lessThan": "ca4fb6c6764b", "versionType": "git"}, {"status": "affected", "version": "7c2ffaf21bd6", "lessThan": "80e679b352c3", "versionType": "git"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "git"}, {"status": "unaffected", "version": "6.8.9", "lessThan": "6.9", "versionType": "git"}, {"status": "unaffected", "version": "6.9", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-13T16:12:12.127Z"}}], "cna": {"title": "tcp: Fix Use-After-Free in tcp_ao_connect_init", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c2ffaf21bd6", "lessThan": "ca4fb6c6764b", "versionType": "git"}, {"status": "affected", "version": "7c2ffaf21bd6", "lessThan": "80e679b352c3", "versionType": "git"}], "programFiles": ["net/ipv4/tcp_ao.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "custom"}, {"status": "unaffected", "version": "6.8.9", "versionType": "custom", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/tcp_ao.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f"}, {"url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix Use-After-Free in tcp_ao_connect_init\n\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\n\nTo prevent this, it should be changed to hlist_for_each_entry_safe."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:28:20.681Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27394", "state": "PUBLISHED", "dateUpdated": "2024-09-10T03:55:12.169Z", "dateReserved": "2024-02-25T13:47:42.677Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-09T16:37:11.495Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: tcp: Fix Use-After-Free in tcp_ao_connect_init", "id": "2280442", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280442"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntcp: Fix Use-After-Free in tcp_ao_connect_init\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\nTo prevent this, it should be changed to hlist_for_each_entry_safe.", "A use-after-free (UAF) vulnerability was found in the TCP implementation of the Linux kernel. This issue occurs when memory that has been deallocated is accessed or incorrectly, potentially leading to security risks, such as data corruption or arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-27394", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27394\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27394\nhttps://lore.kernel.org/linux-cve-announce/2024050836-CVE-2024-27394-4277@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.8.9, kernel 6.9-rc6"}