CVE-2024-27390: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: remove one synchronizenet() barrier in ipv6mcdown()
As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6eventquery() and igmp6eventreport()")) I think the synchronizenet() call in ipv6mcdown() is not needed.
Under load, synchronizenet() can last between 200 usec and 5 ms.
KASAN seems to agree as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27390?
CVE-2024-27390 has been categorized based on the potential impact on system security and performance, typically rated as low to medium severity.
How do I fix CVE-2024-27390?
To fix CVE-2024-27390, you should upgrade to one of the patched Linux kernel versions, such as 5.10.223-1 or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-27390?
CVE-2024-27390 affects Linux kernel versions before the patches were released, specifically versions earlier than 5.10.223-1 and 6.12.11-1.
What component of the Linux kernel is affected by CVE-2024-27390?
CVE-2024-27390 specifically affects the IPv6 multicast component of the Linux kernel.
Is there a workaround for CVE-2024-27390?
Currently, there is no publicly recommended workaround for CVE-2024-27390, and updating the kernel is the advised mitigation.