Linux Kernel TCP-AO Use-After-Free Flaw Traced to RCU Misuse
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Sep 3, 2024
Researchers detailed CVE-2024-27394, a Linux kernel use-after-free flaw in the TCP Authentication Option (TCP-AO) implementation, linking the bug to incorrect use of the kernel’s Read-Copy Update (RCU) synchronization model. The issue affects tcp_ao_connect_init() in net/ipv4/tcp_ao.c, where the kernel iterates over TCP-AO keys with an RCU list macro and schedules key reclamation with call_rcu() without remaining inside an RCU read-side critical section, creating a window in which a freed key can still be accessed.
The analysis showed the bug can be prepared through setsockopt(TCP_AO_ADD_KEY) and triggered during connect() on IPv4 TCP sockets, with a proof of concept reportedly reproducing the fault on Linux kernel 6.8.4 under KASAN and CONFIG_PREEMPT. Researchers said the race can be made more reliable by forcing preemption with reschedule IPIs, widening the interval between reclamation and continued iteration. The fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe to prevent dereferencing a freed next node, and the patch was reported as merged in April and backported to stable kernels.
