CVE-2024-27402

What it actually does

Race condition in phonet/pep receive queue handling allows skb_peek() to return NULL or a pointer to an already-dequeued socket buffer because queues are protected only by per-queue spinlocks rather than the socket lock.

Why it matters to the business

Kernel instability or memory corruption in systems using Phonet protocol can lead to crashes, unexpected reboots, or potential local privilege escalation on affected Linux-based devices and embedded systems.

How an attack unfolds

An attacker with local access triggers concurrent operations on phonet receive queues to win the race between skb_queue_empty() checks and actual dequeuing, causing the kernel to operate on invalid socket buffer pointers that may be leveraged for further memory manipulation.

How to fix it

Update the Linux kernel to a version containing commit 7d3914a477eed92b48c493a8631cc4554ab4fd4f or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 7d3914a477eed92b48c493a8631cc4554ab4fd4f by checking /proc/version or kernel build logs, then verify phonet receive queue access is now protected by the correct locks via code review or dynamic tracing.

Typical attack path

1. Obtain local code execution on a system running a vulnerable Linux kernel with Phonet enabled
2. Craft concurrent socket operations targeting phonet/pep receive paths
3. Win the unprotected race to observe or manipulate dequeued skb pointers
4. Escalate to kernel memory corruption or denial of service

How to detect it

Review kernel logs for unexpected NULL pointer dereferences or socket buffer warnings in phonet/pep paths; examine audit logs for unusual local process activity involving Phonet sockets around crash events.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-user Linux systems within the next patch cycle
• Disable the Phonet protocol module if not required using modprobe blacklist
• Monitor vendor advisories for backported fixes in distribution kernels