CVE-2024-27395: net: openvswitch: Fix Use-After-Free in ovs_ct_exit
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: Fix Use-After-Free in ovsctexit
Since kfreercu, which is called in the hlistforeachentryrcu traversal of ovsctlimitexit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlistforeachentrysafe.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: Fix Use-After-Free in ovsctexit
The Linux kernel CVE team has assigned CVE-2024-27395 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050836-CVE-2024-27395-573e@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.313 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.275 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.216 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.158 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.90 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.30 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Configuration
In ovs_ct_limit_exit (net: openvswitch), replace the hlist_for_each_entry_rcu traversal with hlist_for_each_entry_safe so that the kfree_rcu call during iteration does not allow a use-after-free when an RCU grace period passes during traversal. Vulnerability: CVE-2024-27395.
Linux kernel (net: openvswitch) ovs_ct_limit_exit iteration macro = hlist_for_each_entry_safe (instead of hlist_for_each_entry_rcu)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27395?
CVE-2024-27395 is classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-27395?
To address CVE-2024-27395, upgrade the kernel to version 4.19.313, 5.4.275, 5.10.216, 5.15.158, 6.1.90, or 6.6.30 for Red Hat.
Which systems are affected by CVE-2024-27395?
CVE-2024-27395 affects various versions of the Linux kernel, specifically between 4.18 and 6.8.9.
What types of vulnerabilities does CVE-2024-27395 involve?
CVE-2024-27395 involves a Use-After-Free vulnerability within the net: openvswitch component of the Linux kernel.
Is there a patch available for CVE-2024-27395?
Yes, patches for CVE-2024-27395 are included in the kernel versions mentioned previously.