IM
IronMonkey Threat Research

CVE-2024-27395 HIGH

Published: 2024-05-14 | Last Modified: 2026-08-04 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: openvswitch: Fix Use-After-Free en ovs_ct_exit Dado que kfree_rcu, que se llama en el recorrido hlist_for_each_entry_rcu de ovs_ct_limit_exit, no forma parte de la sección crítica de lectura de RCU, es posible que el período de gracia de RCU pasará durante el recorrido y la clave quedará libre. Para evitar esto, se debe cambiar a hlist_for_each_entry_safe.

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-416

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd36b448800> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2dbc78c80> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2d82aed00> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3846b3480> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd384e85100> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd38677c840> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2d82ac100> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd36b428140> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd2d82aea40> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd38677d980> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd370347cc0> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd384616880> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd36b8ed500> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References