Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-27393

7.5 · HIGH

In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit…

Published May 14, 2024CWE-401EPSS 0.77%

Overview

CVE-2024-27393 is a high-severity vulnerability. It was published on May 14, 2024 and has a CVSS 3.1 base score of 7.5 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen-netfront: Add missing skb_mark_for_recycle

Notice that skb_mark_for_recycle() is introduced later than fixes tag in

commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling").

It is believed that fixes tag were missing a call to page_pool_release_page()

between v5.9 to v5.14, after which is should have used skb_mark_for_recycle().

Since v6.6 the call page_pool_release_page() were removed (in

commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()")

and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch

'net-page_pool-remove-page_pool_release_page'")).

This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch

page_pool memory leaks").

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51fRefgit.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629Refgit.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1Refgit.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6Refgit.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4Refwww.openwall.com/lists/oss-security/2024/05/08/4Refxenbits.xen.org/xsa/advisory-457.htmlRefgit.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51fRefgit.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629Refgit.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1

How CyberStrike helps

Frequently asked questions

What is CVE-2024-27393?

CVE-2024-27393 is a high-severity vulnerability. It was published on May 14, 2024 and has a CVSS 3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-27393?

This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-27393?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-27393?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-27393 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999