CVE-2024-27393: xen-netfront: Add missing skb_mark_for_recycle
In the Linux kernel, the following vulnerability has been resolved:
xen-netfront: Add missing skbmarkforrecycle
Notice that skbmarkforrecycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("pagepool: Allow drivers to hint on SKB recycling").
It is believed that fixes tag were missing a call to pagepoolreleasepage() between v5.9 to v5.14, after which is should have used skbmarkforrecycle(). Since v6.6 the call pagepoolreleasepage() were removed (in commit 535b9c61bdef ("net: pagepool: hide pagepoolreleasepage()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-pagepool-remove-pagepoolreleasepage'")).
This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/pagepool: catch pagepool memory leaks").
Other sources
In the Linux kernel, the following vulnerability has been resolved:
xen-netfront: Add missing skbmarkforrecycle
The Linux kernel CVE team has assigned CVE-2024-27393 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050835-CVE-2024-27393-b804@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.85 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernel (xen-netfront / page_pool)to a version that resolves this vulnerability.Patch CVE-2024-27393
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27393?
CVE-2024-27393 has a moderate severity level affecting the Linux kernel.
How do I fix CVE-2024-27393?
To fix CVE-2024-27393, update the kernel package to versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9 from Red Hat or the specified versions from Debian.
What systems are affected by CVE-2024-27393?
CVE-2024-27393 affects various versions of the Linux kernel on both Red Hat and Debian systems.
What does CVE-2024-27393 affect in the Linux kernel?
CVE-2024-27393 involves a missing function call, skb_mark_for_recycle, in the xen-netfront component of the Linux kernel.
Is there any specific version I should upgrade to resolve CVE-2024-27393?
Yes, users should upgrade to kernel version 5.15.154 or later, or 6.1.85 or later for Red Hat, or the corresponding versions for Debian.