CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use
In the Linux kernel, the following vulnerability has been resolved:
phonet/pep: fix racy skbqueueempty() use
The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27402?
CVE-2024-27402 is considered a moderate severity vulnerability due to its potential impact on Linux kernel functionality.
What impact does CVE-2024-27402 have on Linux systems?
CVE-2024-27402 could lead to unexpected behavior in packet processing by causing skb_peek() to return incorrect values in the Linux kernel.
How do I fix CVE-2024-27402?
To fix CVE-2024-27402, update the Linux kernel to the patched versions provided by your Linux distribution vendor.
Which Linux kernel versions are affected by CVE-2024-27402?
Specific versions of the Linux kernel that include the phonet/pep subsystem are affected by CVE-2024-27402.
Is CVE-2024-27402 publicly disclosed?
Yes, CVE-2024-27402 has been publicly disclosed and is available in the CVE database.