CVE-2024-49982

What it actually does

Incorrect reference counting in the aoe driver allows use-after-free when functions including revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp() invoke aoenet_xmit() without prior dev_hold() calls, after dev_put() was relocated to tx().

Why it matters to the business

Kernel instability, crashes, or memory corruption on systems using ATA over Ethernet; 786 downstream dependents amplify exposure across the ecosystem.

How an attack unfolds

An attacker triggers the listed aoe transmit paths to cause tx() to dereference a freed skb->dev structure; 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors have targeted similar Linux kernel flaws for privilege escalation or denial of service.

How to fix it

Update the Linux kernel to version 4.19.323 or later; apply the referenced patch that adds the missing dev_hold() calls in the affected functions.

How to confirm the fix worked

Verify kernel version is at or above the fixed release; inspect aoe source for dev_hold() before each aoenet_xmit() call and matching dev_put() in tx().

Typical attack path

1. Locate systems exposing aoe devices or network interfaces
2. Issue commands that invoke revalidate(), aoecmd_ata_rw(), resend(), probe(), or aoecmd_cfg_rsp()
3. Force tx() to run after device reference has been dropped
4. Trigger use-after-free to corrupt kernel memory or crash the system

How to detect it

Search kernel logs for aoe-related use-after-free warnings or oops; correlate with network traffic involving ATA-over-Ethernet frames; review threat actor activity in Linux kernel exploitation campaigns.

• aoe:.*use-after-free
• skb->dev refcount underflow
• aoecmd_cfg_pkts
• aoenet_xmit

What your security team should do

• Apply the kernel fix immediately on any system using the aoe driver
• Audit for aoe usage and disable the module where not required
• Monitor for kernel oops or slab corruption involving aoe structures