CVE-2024-26793

Q: What is the severity of CVE-2024-26793?

CVE-2024-26793 has a CVSS score of 7.8 (HIGH). A use-after-free and null pointer dereference vulnerability in the Linux kernel's GTP (GPRS Tunneling Protocol) module allows local attackers to cause denial of service or potentially escalate privileges. The issue occurs when gtp_link_ops operations structure is registered before gtp_net_ops pernet operations structure during module initialization. This affects systems using the GTP kernel module.

7.8 HIGH

Denial of Service

📋 TL;DR

A use-after-free and null pointer dereference vulnerability in the Linux kernel's GTP (GPRS Tunneling Protocol) module allows local attackers to cause denial of service or potentially escalate privileges. The issue occurs when gtp_link_ops operations structure is registered before gtp_net_ops pernet operations structure during module initialization. This affects systems using the GTP kernel module.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions with GTP module support, specifically vulnerable versions before fixes were applied (check specific stable commits for exact ranges).

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems where the GTP kernel module is loaded (typically used for mobile networking/GTP tunneling). Not loaded by default on most systems.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, complete system compromise, or persistent denial of service.

🟠

Likely Case

Kernel panic leading to system crash and denial of service, requiring reboot.

🟢

If Mitigated

Limited to denial of service if kernel hardening features like KASAN are enabled and system is promptly rebooted.

🌐 Internet-Facing: LOW - Requires local access to the system; not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or compromised services could trigger the vulnerability, potentially leading to system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger the gtp_newlink() function. The vulnerability was discovered via syzkaller fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in stable kernel commits: 01129059d5141d62fae692f7a336ae3bc712d3eb, 5366969a19a8a0d2ffb3d27ef6e8905e5e4216f8, 616d82c3cfa2a2146dd7e3ae47bda7e877ee549e, 9376d059a705c5dfaac566c2d09891242013ae16, 93dd420bc41531c9a31498b9538ca83ba6ec191e

Vendor Advisory: https://git.kernel.org/stable/c/01129059d5141d62fae692f7a336ae3bc712d3eb

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check if GTP module is loaded with 'lsmod | grep gtp'. 3. Reboot system to load patched kernel. 4. Verify fix with 'uname -r' and check kernel version.

🔧 Temporary Workarounds

Unload GTP module

linux

Remove the GTP kernel module if not needed, eliminating the attack surface.

sudo rmmod gtp

Blacklist GTP module

linux

Prevent GTP module from being loaded automatically.

echo 'blacklist gtp' | sudo tee /etc/modprobe.d/gtp-blacklist.conf

🧯 If You Can't Patch

Ensure strict access controls to limit local user privileges
Monitor system logs for kernel panics or crashes related to GTP

🔍 How to Verify

Check if Vulnerable:

Check if GTP module is loaded: 'lsmod | grep gtp'. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to a patched version and GTP module loads without errors.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning gtp_newlink, gtp_genl_dump_pdp, or general protection faults
System crash/reboot events with GTP-related stack traces

Network Indicators:

Unusual GTP protocol activity from local users

SIEM Query:

source="kernel" AND ("gtp_newlink" OR "general protection fault" OR "null-ptr-deref")

📊 Metadata

CVE ID: CVE-2024-26793

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: April 4, 2024

Last Updated: December 20, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Unload GTP module

Blacklist GTP module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities