CVE-2024-27394

What it actually does

Use-after-free in tcp_ao_connect_init due to RCU grace period expiring during hlist_for_each_entry_rcu traversal of TCP authentication option keys, allowing freed memory access.

Why it matters to the business

Remote attackers could crash Linux systems or potentially execute arbitrary code with kernel privileges on servers and network devices, leading to downtime, data breaches, and costly incident response.

How an attack unfolds

An attacker initiates a TCP connection using Authentication Option, triggers the hlist traversal in tcp_ao_connect_init, and times the interaction so the RCU grace period frees the key structure before the call_rcu callback completes, resulting in a use-after-free condition.

How to fix it

Upgrade the Linux kernel to the commit ca4fb6c6764b3f75b4f5aa81db1536291897ff7f or later stable releases containing the hlist_for_each_entry_safe change; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit ca4fb6c6764b3f75b4f5aa81db1536291897ff7f via git log or uname; test that tcp_ao_connect_init no longer uses the unsafe traversal.

Typical attack path

1. Establish TCP connection with AO enabled
2. Force repeated hlist_for_each_entry_rcu traversals in tcp_ao_connect_init
3. Wait for RCU grace period to expire during traversal
4. Access the now-freed key structure to corrupt kernel memory
5. Escalate to code execution or denial of service

How to detect it

Search kernel logs for use-after-free warnings or oops related to tcp_ao_connect_init; inspect network traffic for unusual TCP AO connection patterns that coincide with system instability.

What your security team should do

• Prioritize kernel upgrades on all internet-facing Linux systems within 30 days
• Monitor for new stable kernel releases and schedule phased rollouts
• Apply network segmentation to limit exposure of unpatched hosts
• Review TCP AO usage and disable if not required