CVE-2024-27024

What it actually does

Race condition in RDS connection handling allows get_mr() to execute before connection establishment, leading to invalid state transitions and potential kernel memory corruption or privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or gain elevated privileges, disrupting operations and risking data compromise on servers and devices using the RDS protocol.

How an attack unfolds

A local attacker invokes RDS functions to trigger get_mr() on an unestablished connection, races the subsequent connect trigger, and leverages the resulting invalid state for memory manipulation or code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 via git log or uname; test RDS workloads for absence of the prior warning condition.

Typical attack path

1. Obtain local user access on target Linux system
2. Load or interact with RDS protocol sockets
3. Time calls to get_mr() and connection setup to hit the race window
4. Exploit resulting kernel state for escalation or denial of service

How to detect it

Review kernel logs for warnings referencing rds_conn_connect_if_down or get_mr failures; correlate with local process activity involving RDS sockets.

What your security team should do

• Prioritize kernel updates on all systems exposing RDS or high-privilege workloads
• Apply patches within standard maintenance windows given low EPSS and lack of KEV listing
• Monitor upstream kernel changelogs for related RDS fixes