CVE-2024-27388

What it actually does

Memory leak in error-handling paths of gssx_dec_option_array where allocated creds and oa->data structures are not released, allowing gradual kernel memory exhaustion under repeated triggering conditions.

Why it matters to the business

Systems running affected Linux kernel versions may experience increasing memory pressure leading to degraded performance or crashes in RPC and authentication services, with higher urgency for organizations using older Ubuntu LTS releases that have not applied the listed package updates.

How an attack unfolds

An attacker with local access triggers error paths during GSSX option array decoding in SUNRPC by supplying malformed or resource-constrained inputs that cause allocation followed by early return, leaving memory allocated; repeated execution slowly depletes available memory until availability impact manifests.

How to fix it

Update affected packages to the fixed versions provided for each Ubuntu release, such as linux 3.11.0-12.19 for 14.04 LTS, linux 4.4.0-2.16 for 16.04 LTS, linux 4.13.0-16.19 for 18.04 LTS, and corresponding updates for linux-aws, linux-azure, linux-hwe, linux-kvm, linux-oracle and other variants.

How to confirm the fix worked

Verify kernel package versions match or exceed the listed fixed releases using package manager queries; confirm absence of the original vulnerable gssx_dec_option_array error paths via source inspection or by monitoring for continued memory growth after update.

Typical attack path

1. Obtain local user access on target system
2. Identify or trigger code paths invoking gssx_dec_option_array with conditions that force error returns after allocation
3. Repeat triggering to accumulate unreleased memory allocations
4. Monitor for system memory exhaustion or service degradation

How to detect it

Review kernel logs and memory statistics for unexpected growth correlated with SUNRPC or GSS activity; examine process or service logs for repeated GSSX decoding operations that coincide with allocation failures.

What your security team should do

• Prioritize patching all listed Ubuntu 14.04/16.04/18.04 LTS kernel packages to the exact fixed versions
• Monitor memory usage on systems exposing RPC services until patches are applied
• Restrict local access where possible to reduce attack surface for memory exhaustion