CVE-2024-27395: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27395 is a Use-After-Free vulnerability discovered in the Linux kernel's OpenVSwitch component, specifically in the ovs_ct_exit function. The vulnerability was disclosed on May 14, 2024, affecting multiple versions of the Linux kernel from 4.18 through 6.9-rc5. The issue occurs in the net/openvswitch/conntrack.c file where the kfree_rcu call in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit is not properly protected within an RCU read critical section (NVD).

The vulnerability stems from a race condition in the OpenVSwitch connection tracking exit function. Since kfree_rcu is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit and is not part of the RCU read critical section, there is a possibility that the RCU grace period will pass during the traversal, leading to the key being freed prematurely. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to a Use-After-Free condition in the Linux kernel's OpenVSwitch subsystem, which could result in system crashes, memory corruption, or potential privilege escalation. This affects the kernel's network stack functionality, particularly in environments using OpenVSwitch for network virtualization (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is considered low, but no user interaction is needed for exploitation. There are no known reports of this vulnerability being exploited in the wild at the time of disclosure (NVD).

The vulnerability has been fixed by changing the traversal method from hlist_for_each_entry_rcu to hlist_for_each_entry_safe. The fix has been implemented in various kernel versions, including 5.10.216-1~deb10u1 for Debian systems. Multiple Linux distributions have released patches to address this vulnerability (Kernel Patch, Debian LTS).