CVE-2024-27394: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free (UAF) vulnerability was discovered in the TCP implementation of the Linux kernel, identified as CVE-2024-27394. The vulnerability exists in the tcp_ao_connect_init function where a potential use-after-free condition could occur during RCU (Read-Copy-Update) traversal. The issue was discovered and reported in May 2024, affecting the Linux kernel's TCP Authentication Option (TCP-AO) implementation (NVD).

The vulnerability occurs because call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section. This means it's possible for the RCU grace period to pass during the traversal, potentially leading to the key being freed while still in use. The fix involves changing the traversal method from hlist_for_each_entry_rcu to hlist_for_each_entry_safe. The vulnerability has been assigned a CVSS v3.1 base score of 7.4 (HIGH) with the vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially allow an attacker to exploit use-after-free conditions in the TCP stack, which could lead to system crashes, information disclosure, or potential code execution. The high CVSS score indicates that successful exploitation could have severe consequences for affected systems (NVD).

The vulnerability requires local access (AV:L) with high attack complexity (AC:H), but no privileges (PR:N) or user interaction (UI:N) are needed. While the vulnerability has been publicly disclosed, there are no known reports of it being actively exploited in the wild (NVD).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for affected systems, including version 6.8.0-40.40 for Ubuntu 24.04 LTS and corresponding versions for other supported releases. Users are advised to update their systems to the patched versions. The fix involves a code change in the tcp_ao.c file to use a safer list traversal method (Ubuntu Security).