CVE-2024-27396: net: gtp: Fix Use-After-Free in gtp_dellink
In the Linux kernel, the following vulnerability has been resolved:
net: gtp: Fix Use-After-Free in gtpdellink
Since callrcu, which is called in the hlistforeachentryrcu traversal of gtpdellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlistforeachentrysafe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Change the gtp_dellink traversal from hlist_for_each_entry_rcu to hlist_for_each_entry_safe so that objects cannot be freed during iteration when call_rcu is invoked.
Linux kernel (net: gtp) Use hlist_for_each_entry_safe instead of hlist_for_each_entry_rcu = hlist_for_each_entry_safe
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27396?
CVE-2024-27396 is classified with a high severity due to the potential for a use-after-free vulnerability affecting kernel operations.
How do I fix CVE-2024-27396?
To mitigate CVE-2024-27396, upgrade the Linux kernel to one of the fixed versions such as 5.10.223-1 or 6.1.123-1.
What products are affected by CVE-2024-27396?
CVE-2024-27396 affects various versions of the Linux kernel, particularly those in the ranges specified for Debian and other distributions.
What exploit does CVE-2024-27396 enable?
CVE-2024-27396 may allow an attacker to execute arbitrary code or cause a denial of service due to the use-after-free vulnerability in gtp_dellink.
Is there a patch available for CVE-2024-27396?
Yes, patches for CVE-2024-27396 are included in the updated Linux kernel versions released by various distributions.