GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-27388 (GCVE-0-2024-27388)

Vulnerability from cvelistv5 – Published: 2024-05-01 13:05 – Updated: 2026-08-05 11:29
VLAI
Title
SUNRPC: fix some memleaks in gssx_dec_option_array
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:43 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < b97c37978ca825557d331c9012e0c1ddc0e42364 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < dd292e884c649f9b1c18af0ec75ca90b390cd044 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < 934212a623cbab851848b6de377eb476718c3e4c (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < 5e6013ae2c8d420faea553d363935f65badd32c3 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < 996997d1fb2126feda550d6adcedcbd94911fc69 (git)
Affected: 1d658336b05f8697d6445834f8867f8ad5e4f735 , < 3cfcfc102a5e57b021b786a755a38935e357797d (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 4.19.311 , ≤ 4.19.* (semver)
Unaffected: 5.4.273 , ≤ 5.4.* (semver)
Unaffected: 5.10.214 , ≤ 5.10.* (semver)
Unaffected: 5.15.153 , ≤ 5.15.* (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.507Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:43:49.125516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:28.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b97c37978ca825557d331c9012e0c1ddc0e42364",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "dd292e884c649f9b1c18af0ec75ca90b390cd044",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "934212a623cbab851848b6de377eb476718c3e4c",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "5e6013ae2c8d420faea553d363935f65badd32c3",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "996997d1fb2126feda550d6adcedcbd94911fc69",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "3cfcfc102a5e57b021b786a755a38935e357797d",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.311",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.273",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix some memleaks in gssx_dec_option_array\n\nThe creds and oa-\u003edata need to be freed in the error-handling paths after\ntheir allocation. So this patch add these deallocations in the\ncorresponding paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable decoder is executed only as a direct consequence of an RPCSEC_GSS_INIT request arriving at in-kernel nfsd over TCP/2049, so a remote NFS client drives entry into the code and controls how often it runs. Although the malformed/short XDR reply is delivered by the local gssproxy daemon, the attacker\u0027s reach to the vulnerable function is purely over the network.\nAC:L - The attacker can invoke the upcall path an unlimited number of times pre-authentication, and each invocation pins 256 KB of receive pages plus the in-token pages, letting the attacker themselves create the slab/memory-pressure condition under which the `kzalloc(struct svc_cred)` fails and the dangling-pointer path is taken (trivially so for a memcg-limited/containerized nfsd). The attacker also influences gssproxy reply size via principal name length and group-list size, driving the `-ENOSPC` decode-error paths, so the required conditions are attacker-inducible rather than beyond their control.\nPR:N - `svcauth_gss_proxy_init()` is reached from `svcauth_gss_proc_init()` on the very first leg of the GSS handshake, before any Kerberos credential is validated \u2014 the upcall is performed even for a garbage input token. No account, key, or prior authentication on the NFS server is needed.\nUI:N - The path is triggered entirely by an inbound RPC from the attacker; no administrator or user of the target system needs to mount, click, or open anything.\nS:U - The corrupted objects (`gssx_option`, `svc_cred`) and the resulting heap damage are all inside the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - With `oa-\u003ecount == 1` and `oa-\u003edata` dangling, `gssp_accept_sec_context_upcall()` reads `res.options.data[0].value` out of a freed kmalloc-32 object and then dereferences the pointer it finds there into `data-\u003ecreds`, so freed/reallocated kernel memory contents are consumed and can populate `cr_uid`/`cr_gid`/`cr_principal` \u2014 a use-after-free read that both discloses kernel memory and can determine the identity the NFS client is authenticated as.\nI:H - The same path yields `kfree()` of a pointer taken from freed memory plus a double free of `oa-\u003edata`, and later `free_svc_cred()` performs `put_group_info()`, `gss_mech_put()` and further `kfree()`s on attacker-groomable pointers \u2014 an arbitrary-free and arbitrary-refcount-decrement primitive that is a well-established route to controlled heap corruption and control-flow hijack.\nA:H - The double free trips SLUB\u0027s free-object detection (`BUG`/panic, fatal with `panic_on_oops` on the appliance and NAS deployments where nfsd+gssproxy is typical), and the NULL `oa-\u003edata` variant of the same incoherent `oa-\u003ecount` faults immediately in the caller. The unbounded, remotely repeatable leakage of the decoder\u0027s allocations additionally drives the server toward OOM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:23.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044"
        },
        {
          "url": "https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4"
        },
        {
          "url": "https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d"
        }
      ],
      "title": "SUNRPC: fix some memleaks in gssx_dec_option_array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27388",
    "datePublished": "2024-05-01T13:05:05.518Z",
    "dateReserved": "2024-02-25T13:47:42.676Z",
    "dateUpdated": "2026-08-05T11:29:23.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27388",
      "date": "2026-09-15",
      "epss": "0.00959",
      "percentile": "0.59623"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.10\", \"versionEndExcluding\": \"4.19.311\", \"matchCriteriaId\": \"AA8D2CD8-65D2-47A7-9391-35AFA94D8CCC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.273\", \"matchCriteriaId\": \"620FD8B7-BF03-43E0-951A-0A58461D4C55\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.214\", \"matchCriteriaId\": \"65987874-467B-4D3B-91D6-68A129B34FB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.153\", \"matchCriteriaId\": \"ACB69438-845D-4E3C-B114-3140611F9C0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.83\", \"matchCriteriaId\": \"121A07F6-F505-4C47-86BF-9BB6CC7B6C19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.23\", \"matchCriteriaId\": \"E00814DC-0BA7-431A-9926-80FEB4A96C68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.11\", \"matchCriteriaId\": \"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.2\", \"matchCriteriaId\": \"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: fix some memleaks in gssx_dec_option_array\\n\\nThe creds and oa-\u003edata need to be freed in the error-handling paths after\\ntheir allocation. So this patch add these deallocations in the\\ncorresponding paths.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: SUNRPC: corrige algunas fugas de mem en gssx_dec_option_array Los creds y oa-\u0026gt;data deben liberarse en las rutas de manejo de errores despu\\u00e9s de su asignaci\\u00f3n. Entonces este parche agrega estas desasignaciones en las rutas correspondientes.\"}]",
      "id": "CVE-2024-27388",
      "lastModified": "2025-01-14T14:56:08.617",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-01T13:15:51.550",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-15T00:00:00.000Z",
      "cve": "CVE-2024-27388",
      "id": "msrc_CVE-2024-27388",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: fix some memleaks in gssx_dec_option_array",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27388.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27388\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:51.550\",\"lastModified\":\"2026-08-04T11:17:41.237\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: fix some memleaks in gssx_dec_option_array\\n\\nThe creds and oa-\u003edata need to be freed in the error-handling paths after\\ntheir allocation. So this patch add these deallocations in the\\ncorresponding paths.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: SUNRPC: corrige algunas fugas de mem en gssx_dec_option_array Los creds y oa-\u0026gt;data deben liberarse en las rutas de manejo de errores despu\u00e9s de su asignaci\u00f3n. Entonces este parche agrega estas desasignaciones en las rutas correspondientes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"b97c37978ca825557d331c9012e0c1ddc0e42364\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"dd292e884c649f9b1c18af0ec75ca90b390cd044\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"934212a623cbab851848b6de377eb476718c3e4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"5e6013ae2c8d420faea553d363935f65badd32c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"996997d1fb2126feda550d6adcedcbd94911fc69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d658336b05f8697d6445834f8867f8ad5e4f735\",\"lessThan\":\"3cfcfc102a5e57b021b786a755a38935e357797d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.311\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.273\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.214\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.153\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.83\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:43:49.125516Z\",\"id\":\"CVE-2024-27388\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10\",\"versionEndExcluding\":\"4.19.311\",\"matchCriteriaId\":\"AA8D2CD8-65D2-47A7-9391-35AFA94D8CCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.273\",\"matchCriteriaId\":\"620FD8B7-BF03-43E0-951A-0A58461D4C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.214\",\"matchCriteriaId\":\"65987874-467B-4D3B-91D6-68A129B34FB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.153\",\"matchCriteriaId\":\"ACB69438-845D-4E3C-B114-3140611F9C0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.83\",\"matchCriteriaId\":\"121A07F6-F505-4C47-86BF-9BB6CC7B6C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:07:39+00:00",
      "cve": "CVE-2024-27388",
      "id": "CVE-2024-27388",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: fix some memleaks in gssx_dec_option_array",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27388.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:56:06Z",
      "cve": "CVE-2024-27388",
      "id": "CVE-2024-27388",
      "initial_release_date": "2024-05-03T02:09:31Z",
      "product_status:known_affected": "577",
      "product_status:known_not_affected": "13",
      "product_status:recommended": "799",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27388",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27388.json",
      "version": "111"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.507Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27388\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:43:49.125516Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.874Z\"}}], \"cna\": {\"title\": \"SUNRPC: fix some memleaks in gssx_dec_option_array\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable decoder is executed only as a direct consequence of an RPCSEC_GSS_INIT request arriving at in-kernel nfsd over TCP/2049, so a remote NFS client drives entry into the code and controls how often it runs. Although the malformed/short XDR reply is delivered by the local gssproxy daemon, the attacker\u0027s reach to the vulnerable function is purely over the network.\\nAC:L - The attacker can invoke the upcall path an unlimited number of times pre-authentication, and each invocation pins 256 KB of receive pages plus the in-token pages, letting the attacker themselves create the slab/memory-pressure condition under which the `kzalloc(struct svc_cred)` fails and the dangling-pointer path is taken (trivially so for a memcg-limited/containerized nfsd). The attacker also influences gssproxy reply size via principal name length and group-list size, driving the `-ENOSPC` decode-error paths, so the required conditions are attacker-inducible rather than beyond their control.\\nPR:N - `svcauth_gss_proxy_init()` is reached from `svcauth_gss_proc_init()` on the very first leg of the GSS handshake, before any Kerberos credential is validated \\u2014 the upcall is performed even for a garbage input token. No account, key, or prior authentication on the NFS server is needed.\\nUI:N - The path is triggered entirely by an inbound RPC from the attacker; no administrator or user of the target system needs to mount, click, or open anything.\\nS:U - The corrupted objects (`gssx_option`, `svc_cred`) and the resulting heap damage are all inside the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - With `oa-\u003ecount == 1` and `oa-\u003edata` dangling, `gssp_accept_sec_context_upcall()` reads `res.options.data[0].value` out of a freed kmalloc-32 object and then dereferences the pointer it finds there into `data-\u003ecreds`, so freed/reallocated kernel memory contents are consumed and can populate `cr_uid`/`cr_gid`/`cr_principal` \\u2014 a use-after-free read that both discloses kernel memory and can determine the identity the NFS client is authenticated as.\\nI:H - The same path yields `kfree()` of a pointer taken from freed memory plus a double free of `oa-\u003edata`, and later `free_svc_cred()` performs `put_group_info()`, `gss_mech_put()` and further `kfree()`s on attacker-groomable pointers \\u2014 an arbitrary-free and arbitrary-refcount-decrement primitive that is a well-established route to controlled heap corruption and control-flow hijack.\\nA:H - The double free trips SLUB\u0027s free-object detection (`BUG`/panic, fatal with `panic_on_oops` on the appliance and NAS deployments where nfsd+gssproxy is typical), and the NULL `oa-\u003edata` variant of the same incoherent `oa-\u003ecount` faults immediately in the caller. The unbounded, remotely repeatable leakage of the decoder\u0027s allocations additionally drives the server toward OOM.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"b97c37978ca825557d331c9012e0c1ddc0e42364\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"dd292e884c649f9b1c18af0ec75ca90b390cd044\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"934212a623cbab851848b6de377eb476718c3e4c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"5e6013ae2c8d420faea553d363935f65badd32c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"996997d1fb2126feda550d6adcedcbd94911fc69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d658336b05f8697d6445834f8867f8ad5e4f735\", \"lessThan\": \"3cfcfc102a5e57b021b786a755a38935e357797d\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.311\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.273\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.214\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.153\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364\"}, {\"url\": \"https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\"}, {\"url\": \"https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\"}, {\"url\": \"https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044\"}, {\"url\": \"https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4c\"}, {\"url\": \"https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3\"}, {\"url\": \"https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\"}, {\"url\": \"https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69\"}, {\"url\": \"https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: fix some memleaks in gssx_dec_option_array\\n\\nThe creds and oa-\u003edata need to be freed in the error-handling paths after\\ntheir allocation. So this patch add these deallocations in the\\ncorresponding paths.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.311\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.273\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.214\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.153\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.83\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:23.858Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27388\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:23.858Z\", \"dateReserved\": \"2024-02-25T13:47:42.676Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T13:05:05.518Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.