CVE-2024-27431

Q: What is the severity of CVE-2024-27431?

CVE-2024-27431 has a CVSS score of 5.5 (MEDIUM). This CVE describes an information disclosure vulnerability in the Linux kernel's cpumap XDP (eXpress Data Path) subsystem. When XDP programs run on cpumap entries, the xdp_rxq_info structure isn't initialized, potentially leaking kernel memory contents through the rx_queue_index field. This affects Linux systems using XDP programs with cpumap.

5.5 MEDIUM

📋 TL;DR

This CVE describes an information disclosure vulnerability in the Linux kernel's cpumap XDP (eXpress Data Path) subsystem. When XDP programs run on cpumap entries, the xdp_rxq_info structure isn't initialized, potentially leaking kernel memory contents through the rx_queue_index field. This affects Linux systems using XDP programs with cpumap.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; typically affects multiple stable kernel versions before the fix commits.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using XDP programs with cpumap functionality. Requires CAP_BPF or CAP_NET_ADMIN capabilities to load XDP programs.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory contents could be leaked to unprivileged userspace processes, potentially exposing sensitive data like cryptographic keys, process memory, or other kernel structures.

🟠

Likely Case

Information disclosure of random kernel memory contents to XDP programs, which could be used to infer kernel state or aid other attacks.

🟢

If Mitigated

Minimal impact if XDP programs don't use or trust the rx_queue_index value, or if cpumap XDP isn't enabled.

🌐 Internet-Facing: LOW - This requires local access or specialized network configurations using XDP programs.

🏢 Internal Only: MEDIUM - Internal attackers with ability to load XDP programs could exploit this for information gathering.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to load XDP programs and access to cpumap functionality. The vulnerability provides information disclosure rather than code execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 2487007aa3b9fafbd2cb14068f49791ce1d7ede5, 3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95, 5f4e51abfbe6eb444fa91906a5cd083044278297, eaa7cb836659ced2d9f814ac32aa3ec193803ed6, or f0363af9619c77730764f10360e36c6445c12f7b

Vendor Advisory: https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable XDP cpumap functionality

linux

Prevent loading of XDP programs that use cpumap entries

sysctl -w net.core.bpf_jit_enable=0
Restrict CAP_BPF and CAP_NET_ADMIN capabilities

🧯 If You Can't Patch

Restrict CAP_BPF and CAP_NET_ADMIN capabilities to trusted users only
Monitor for unauthorized XDP program loading attempts

🔍 How to Verify

Check if Vulnerable:

Check if XDP programs are loaded and using cpumap: bpftool prog show | grep -i xdp; Check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: uname -r; Check git commit history for your kernel version

📡 Detection & Monitoring

Log Indicators:

Audit logs showing XDP program loading (BPF_PROG_LOAD)
Kernel logs related to XDP or BPF errors

Network Indicators:

Unusual network performance patterns from XDP programs

SIEM Query:

event.category:process AND process.name:bpftool OR cmdline:*xdp* OR process.name:*bpf*

📊 Metadata

CVE ID: CVE-2024-27431

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

Published: May 17, 2024

Last Updated: December 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable XDP cpumap functionality

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities