CVE-2024-27010: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27010 affects the Linux kernel's network scheduling (net/sched) component, specifically related to the mirred action functionality. The vulnerability was discovered in May 2024 and affects Linux kernel versions from 4.2 up to (excluding) 6.8.8, as well as 6.9 release candidates (rc1-rc4). The issue occurs when the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to itself, resulting in a qdisc lock deadlock condition (NVD).

The vulnerability manifests as a recursive locking scenario in the kernel's traffic control (tc) subsystem. When using mirred action with specific qdisc configurations, the system attempts to acquire the same lock twice, leading to a deadlock. The CVSS v3.1 base score is 5.5 (Medium), with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue stems from improper locking mechanisms when handling packet redirection or mirroring to the same device (NVD, Kernel Patch).

The vulnerability can result in a local denial of service condition when specific traffic control configurations are used. When triggered, it causes a kernel deadlock that can affect network packet processing and potentially impact system stability. The issue specifically affects systems using the mirred action in traffic control configurations that involve self-redirection or mirroring (NVD).

The vulnerability requires local access and specific traffic control (tc) configurations to be exploited. Example configurations that can trigger the issue include setting up mirred actions that redirect traffic from a device to itself (eth0->eth0) or creating a redirection loop between two devices (eth0->eth1->eth0). The exploit requires privileged access to configure traffic control rules (Kernel Patch).

The issue has been fixed by adding an owner field (CPU id) to struct Qdisc that is set after root qdisc is entered. When the softirq enters it a second time, if the qdisc owner is the same CPU, the packet is dropped to break the loop. The fix is available in Linux kernel version 6.8.8 and later. Users should update to patched kernel versions to mitigate this vulnerability (Kernel Patch).