Log in Start free

Vulnerability · Published May 9, 2024 · Assigned by Linux

CVE-2024-27395net: openvswitch: Fix Use-After-Free in ovs_ct_exit

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.90-1DEBIAN-CVE-2024-27395
Debian:13linux6.8.9-1DEBIAN-CVE-2024-27395
Debian:14linux6.8.9-1DEBIAN-CVE-2024-27395
Ubuntu:22.04:LTSlinux5.15.0-116.126UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux6.8.0-40.40UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux6.8.0-40.40USN-6949-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-aws5.15.0-1065.71UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-aws6.8.0-1013.14USN-6949-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1013.14UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure5.15.0-1068.77UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-azure6.8.0-1012.14UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-azure6.8.0-1012.14USN-6952-2
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1012.14~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1068.77.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gcp5.15.0-1064.72UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-gcp6.8.0-1012.13USN-6949-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1012.13UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1012.13~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-gke5.15.0-1062.68UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-gke6.8.0-1008.11UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-gke6.8.0-1008.11USN-6949-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1048.55UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-40.40~22.04.3UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-ibm5.15.0-1058.61UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-ibm6.8.0-1010.10UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-ibm6.8.0-1010.10USN-6949-1
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1060.66UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-kvm5.15.0-1062.67UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-116.126UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-40.40.1USN-6949-2
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-40.40.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1060.61UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1011.11UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1011.11USN-6949-1
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1011.11~22.04.1USN-6949-1
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1011.11~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1011.11.1UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1011.11.1USN-6952-1
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1026.26UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1015.15UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1010.10USN-6955-1
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1010.10UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oracle5.15.0-1063.69UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-oracle6.8.0-1010.10UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-oracle6.8.0-1010.10USN-6952-1
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-raspi5.15.0-1058.61UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-raspi6.8.0-1009.10UBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-raspi6.8.0-1009.10USN-6949-2
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-27395
Ubuntu:24.04:LTSlinux-riscv6.8.0-40.40.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-27395
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1035.39UBUNTU-CVE-2024-27395

Affected products (as reported)

VendorProductVersions
Linux Linux 11efd5cb04a184eea4f57b68ea63dddd463158d1 – before 2db9a8c0a01fa1c762c1e61a13c212c49275299411efd5cb04a184eea4f57b68ea63dddd463158d1 – before 589523cf0b384164e445dd5db8d5b1bf9798242411efd5cb04a184eea4f57b68ea63dddd463158d1 – before 35880c3fa6f8fe281a19975d2992644588ca33d311efd5cb04a184eea4f57b68ea63dddd463158d1 – before 9048616553c65e750d43846f225843ed745ec0d411efd5cb04a184eea4f57b68ea63dddd463158d1 – before bca6fa2d9a9f560e6b89fd5190b05cc2f5d422c111efd5cb04a184eea4f57b68ea63dddd463158d1 – before eaa5e164a2110d2fb9e16c8a29e450188223513711efd5cb04a184eea4f57b68ea63dddd463158d1 – before edee0758747d7c219e29db9ed1d4eb33e8d3286511efd5cb04a184eea4f57b68ea63dddd463158d1 – before 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2
Linux Linux 4.18

References