CVE-2024-26872
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's RDMA/srpt subsystem allows attackers to potentially crash the kernel or execute arbitrary code. This affects systems using RDMA (Remote Direct Memory Access) with the srpt driver. The vulnerability occurs due to improper event handler registration timing during device initialization.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.
Likely Case
System instability, kernel crashes, or denial of service affecting RDMA functionality.
If Mitigated
Limited impact if RDMA is not used or if proper kernel hardening measures are in place.
🎯 Exploit Status
Exploitation requires triggering a race condition during device initialization, making reliable exploitation challenging. Requires RDMA access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel commits provided (e.g., 6413e78086caf7bf15639923740da0d91fdfd090)
Vendor Advisory: https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090
Restart Required: Yes
Instructions:
1. Update to a patched Linux kernel version containing the fix. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot the system after kernel update.
🔧 Temporary Workarounds
Disable RDMA/srpt module
linuxPrevent loading of the vulnerable srpt driver if RDMA functionality is not required
echo 'blacklist srpt' >> /etc/modprobe.d/blacklist.conf
rmmod srpt
🧯 If You Can't Patch
- Restrict RDMA network access using firewall rules to trusted hosts only
- Monitor system logs for kernel panics or unusual RDMA-related errors
🔍 How to Verify
Check if Vulnerable:
Check if srpt module is loaded: lsmod | grep srpt. If loaded and kernel version is unpatched, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes one of the fix commits: uname -r and check with distribution vendor. Confirm srpt module functions normally after update.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- Use-after-free KASAN reports in dmesg
- RDMA/srpt initialization errors
Network Indicators:
- Unusual RDMA traffic patterns from untrusted sources
SIEM Query:
source="kernel" AND ("use-after-free" OR "KASAN" OR "srpt" OR "RDMA")🔗 References
- https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090
- https://git.kernel.org/stable/c/7104a00fa37ae898a827381f1161fa3286c8b346
- https://git.kernel.org/stable/c/85570b91e4820a0db9d9432098778cafafa7d217
- https://git.kernel.org/stable/c/bdd895e0190c464f54f84579e7535d80276f0fc5
- https://git.kernel.org/stable/c/c21a8870c98611e8f892511825c9607f1e2cd456
- https://git.kernel.org/stable/c/e362d007294955a4fb929e1c8978154a64efdcb6
- https://git.kernel.org/stable/c/ec77fa12da41260c6bf9e060b89234b980c5130f
- https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090
- https://git.kernel.org/stable/c/7104a00fa37ae898a827381f1161fa3286c8b346
- https://git.kernel.org/stable/c/85570b91e4820a0db9d9432098778cafafa7d217
- https://git.kernel.org/stable/c/bdd895e0190c464f54f84579e7535d80276f0fc5
- https://git.kernel.org/stable/c/c21a8870c98611e8f892511825c9607f1e2cd456
- https://git.kernel.org/stable/c/e362d007294955a4fb929e1c8978154a64efdcb6
- https://git.kernel.org/stable/c/ec77fa12da41260c6bf9e060b89234b980c5130f
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
