Linux Kernel
CVE-2024-27394
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local UAF in kernel context reachable by low-privileged user; no network vector, no user interaction; full C/I/A kernel-level impact when triggered.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix Use-After-Free in tcp_ao_connect_init
Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlist_for_each_entry_safe.
AnalysisAI
Use-After-Free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem within tcp_ao_connect_init exposes local attackers with low-privileged accounts to memory corruption that can lead to kernel privilege escalation, information disclosure, or denial of service. The flaw exists because call_rcu is invoked during an hlist_for_each_entry_rcu traversal outside the RCU read critical section, allowing the RCU grace period to expire mid-traversal and the referenced key structure to be freed while still in use. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.26% (18th percentile), indicating limited observed exploitation activity despite the High CVSS score.
Technical ContextAI
TCP Authentication Option (TCP-AO, RFC 5925) is a kernel-level mechanism for cryptographically authenticating TCP segments. The affected code path, tcp_ao_connect_init, iterates over a hash list of TCP-AO keys using hlist_for_each_entry_rcu - an iterator designed for use inside an RCU read-side critical section (rcu_read_lock/rcu_read_unlock). However, call_rcu is invoked within this traversal loop without being enclosed in such a critical section. Because call_rcu schedules deferred freeing after a grace period, and because no read-side lock is held, the grace period can elapse during the traversal itself, causing the key object to be freed while the loop still holds a pointer to it - a textbook CWE-416 Use-After-Free. The fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe, which captures the next pointer before any potential free, making the traversal safe against concurrent reclamation. Affected CPEs span the entire Linux kernel product line through 6.9-rc5.
RemediationAI
Apply the upstream kernel fix by updating to a kernel version that incorporates commits 80e679b352c3ce5158f3f778cfb77eb767e586fb or ca4fb6c6764b3f75b4f5aa81db1536291797ff7f from the stable tree; consult your Linux distribution's security advisories (e.g., RHSA, USN, DSA) for the specific patched package version applicable to your distribution. As an interim compensating control, disabling TCP-AO on systems that do not require RFC 5925 TCP segment authentication eliminates the vulnerable code path entirely - this is achievable via firewall policy or by ensuring no tcp_ao socket options are configured. Restricting local user access to the minimum necessary (principle of least privilege) reduces the attacker surface, since exploitation requires a local shell account. Note that neither compensating control substitutes for the kernel patch on systems where TCP-AO is operationally required.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today