CVE-2024-27394 (GCVE-0-2024-27394)

Vulnerability from cvelistv5 – Published: 2024-05-09 16:37 – Updated: 2026-08-05 11:29
VLAI
Title
tcp: Fix Use-After-Free in tcp_ao_connect_init
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f , < ca4fb6c6764b3f75b4f5aa81db1536291897ff7f (git)
Affected: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f , < 80e679b352c3ce5158f3f778cfb77eb767e586fb (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: 6.7
    cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 7c2ffaf21bd6 , < ca4fb6c6764b (git)
Affected: 7c2ffaf21bd6 , < 80e679b352c3 (git)
Unaffected: 0 , < 6.7 (git)
Unaffected: 6.8.9 , < 6.9 (git)
Unaffected: 6.9 , ≤ * (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "ca4fb6c6764b",
                "status": "affected",
                "version": "7c2ffaf21bd6",
                "versionType": "git"
              },
              {
                "lessThan": "80e679b352c3",
                "status": "affected",
                "version": "7c2ffaf21bd6",
                "versionType": "git"
              },
              {
                "lessThan": "6.7",
                "status": "unaffected",
                "version": "0",
                "versionType": "git"
              },
              {
                "lessThan": "6.9",
                "status": "unaffected",
                "version": "6.8.9",
                "versionType": "git"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.9",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27394",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T03:55:12.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca4fb6c6764b3f75b4f5aa81db1536291897ff7f",
              "status": "affected",
              "version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
              "versionType": "git"
            },
            {
              "lessThan": "80e679b352c3ce5158f3f778cfb77eb767e586fb",
              "status": "affected",
              "version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ao.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix Use-After-Free in tcp_ao_connect_init\n\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\n\nTo prevent this, it should be changed to hlist_for_each_entry_safe."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable loop is only reached from the active-open path (`connect()` \u2192 `tcp_connect()` \u2192 `tcp_connect_init()` \u2192 `tcp_ao_connect_init()`) on a socket the attacker first configures via `setsockopt(TCP_AO_ADD_KEY)`; a remote peer has no influence over it, so local syscall access is required.\nAC:L - The attacker controls both sides of the window \u2014 they choose how many keys are queued for `call_rcu` (hundreds per socket, bounded only by optmem_max), can pin CPUs and generate scheduling pressure to force preemption between `call_rcu` and the `key-\u003enode.next` dereference, and can retry the entire sequence indefinitely at negligible cost.\nPR:L - `TCP_AO_ADD_KEY` and the `connect()` path carry no capability check whatsoever in `do_tcp_setsockopt()` or `tcp_ao_add_cmd()`, so any unprivileged local user with an ordinary TCP socket can set this up.\nUI:N - The attacker performs every step (socket creation, key insertion, connect) in its own process; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Traversal continues through a freed and potentially reclaimed `tcp_ao_key`, letting the attacker steer reads into attacker-groomed memory and, via the resulting unlink/free primitives, leverage the UAF into disclosure of arbitrary kernel memory.\nI:H - `hlist_del_rcu()` on the stale entry gives an attacker-influenced unlink write (`*pprev = next; next-\u003epprev = pprev`), and the subsequent `call_rcu()` on a bogus `rcu_head` yields a deferred arbitrary `kfree()` \u2014 a combination that is exploitable for control-flow hijack and privilege escalation.\nA:H - Even without successful grooming, dereferencing freed/poisoned slab memory and unlinking through a garbage pointer reliably produces a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:28.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb"
        }
      ],
      "title": "tcp: Fix Use-After-Free in tcp_ao_connect_init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27394",
    "datePublished": "2024-05-09T16:37:11.495Z",
    "dateReserved": "2024-02-25T13:47:42.677Z",
    "dateUpdated": "2026-08-05T11:29:28.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27394",
      "date": "2026-08-04",
      "epss": "0.00262",
      "percentile": "0.17832"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Fix Use-After-Free in tcp_ao_connect_init\\n\\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\\nis possible that the RCU grace period will pass during the traversal and\\nthe key will be free.\\n\\nTo prevent this, it should be changed to hlist_for_each_entry_safe.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: Fix Use-After-Free en tcp_ao_connect_init Dado que call_rcu, que se llama en el recorrido hlist_for_each_entry_rcu de tcp_ao_connect_init, no forma parte de la secci\\u00f3n cr\\u00edtica de lectura de RCU, es posible que el El per\\u00edodo de gracia de RCU transcurrir\\u00e1 durante el recorrido y la clave quedar\\u00e1 gratuita. Para evitar esto, se debe cambiar a hlist_for_each_entry_safe.\"}]",
      "id": "CVE-2024-27394",
      "lastModified": "2024-11-21T09:04:31.353",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.4, \"impactScore\": 5.9}]}",
      "published": "2024-05-14T15:12:27.363",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27394\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-14T15:12:27.363\",\"lastModified\":\"2026-08-04T11:17:42.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Fix Use-After-Free in tcp_ao_connect_init\\n\\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\\nis possible that the RCU grace period will pass during the traversal and\\nthe key will be free.\\n\\nTo prevent this, it should be changed to hlist_for_each_entry_safe.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: Fix Use-After-Free en tcp_ao_connect_init Dado que call_rcu, que se llama en el recorrido hlist_for_each_entry_rcu de tcp_ao_connect_init, no forma parte de la secci\u00f3n cr\u00edtica de lectura de RCU, es posible que el El per\u00edodo de gracia de RCU transcurrir\u00e1 durante el recorrido y la clave quedar\u00e1 gratuita. Para evitar esto, se debe cambiar a hlist_for_each_entry_safe.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_ao.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f\",\"lessThan\":\"ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f\",\"lessThan\":\"80e679b352c3ce5158f3f778cfb77eb767e586fb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_ao.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.9\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"7c2ffaf21bd6\",\"lessThan\":\"ca4fb6c6764b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c2ffaf21bd6\",\"lessThan\":\"80e679b352c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"git\",\"status\":\"unaffected\"},{\"version\":\"6.8.9\",\"lessThan\":\"6.9\",\"versionType\":\"git\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.4,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-04T00:00:00+00:00\",\"id\":\"CVE-2024-27394\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.9\",\"matchCriteriaId\":\"5F9041E5-8358-4EF7-8F98-B812EDE49612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:36:24+00:00",
      "cve": "CVE-2024-27394",
      "id": "CVE-2024-27394",
      "initial_release_date": "2024-05-08T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: Fix Use-After-Free in tcp_ao_connect_init",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27394.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T01:53:15Z",
      "cve": "CVE-2024-27394",
      "id": "CVE-2024-27394",
      "initial_release_date": "2024-05-11T02:34:36Z",
      "product_status:known_not_affected": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27394",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27394.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.373Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27394\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-05T03:56:15.841644Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}], \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"7c2ffaf21bd6\", \"lessThan\": \"ca4fb6c6764b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7c2ffaf21bd6\", \"lessThan\": \"80e679b352c3\", \"versionType\": \"git\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"git\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"lessThan\": \"6.9\", \"versionType\": \"git\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-13T16:12:12.127Z\"}}], \"cna\": {\"title\": \"tcp: Fix Use-After-Free in tcp_ao_connect_init\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f\", \"lessThan\": \"ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f\", \"lessThan\": \"80e679b352c3ce5158f3f778cfb77eb767e586fb\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/tcp_ao.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/tcp_ao.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ca4fb6c6764b3f75b4f5aa81db1536291897ff7f\"}, {\"url\": \"https://git.kernel.org/stable/c/80e679b352c3ce5158f3f778cfb77eb767e586fb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: Fix Use-After-Free in tcp_ao_connect_init\\n\\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\\nof tcp_ao_connect_init, is not part of the RCU read critical section, it\\nis possible that the RCU grace period will pass during the traversal and\\nthe key will be free.\\n\\nTo prevent this, it should be changed to hlist_for_each_entry_safe.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:22:23.596Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27394\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:22:23.596Z\", \"dateReserved\": \"2024-02-25T13:47:42.677Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-09T16:37:11.495Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.