PT-2024-3616 · Linux+5 · Linux Kernel+5
Hyunwoo Kim
·
Published
2024-04-24
·
Updated
2025-02-03
·
CVE-2024-27396
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a Use-After-Free vulnerability in the
gtp dellink function. This vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information. The problem arises because call rcu, which is called in the hlist for each entry rcu traversal of gtp dellink, is not part of the RCU read critical section. As a result, the RCU grace period may pass during the traversal, and the key may be freed. To prevent this, it should be changed to hlist for each entry safe.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu