Linux Kernel up to 6.8.8/6.9-rc5 tcp_ao_connect_init use after free

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.8.8/6.9-rc5. Affected by this vulnerability is the function tcp_ao_connect_init. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2024-27394. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.8.8/6.9-rc5. This vulnerability affects the function tcp_ao_connect_init. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2024-27394 since 02/25/2024. The exploitation appears to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/06/2024).

Upgrading to version 6.8.9 or 6.9-rc6 eliminates this vulnerability. Applying the patch ca4fb6c6764b/80e679b352c3 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.8.8
• 6.9-rc1
• 6.9-rc2
• 6.9-rc3
• 6.9-rc4
• 6.9-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion