LiveActive security incident?Get immediate response
CVE Record

CVE-2024-27013: tun: limit printing rate when illegal packet received by tun dev

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected. net_ratelimit mechanism can be used to limit the dumping rate. PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980" #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663 [exception RIP: io_serial_in+20] RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002 RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0 RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020 R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594 #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306 #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72 #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-27013 is a Linux kernel availability flaw in the TUN virtual network driver. Repeated illegal packets can make the kernel spend excessive CPU printing packet dumps, especially when console logging is enabled, and may trigger a soft lockup. The business risk is service disruption on exposed Linux systems, not data theft based on the provided sources.

Executive priority

Prioritize according to availability impact. Patch shared virtualization, hosting, and appliance environments sooner; handle low-criticality endpoints in normal kernel maintenance. Evidence does not support emergency treatment, but Linux kernel availability bugs can have broad operational blast radius.

Technical view

vhost_worker can call TUN receive callbacks. When tun_do_read receives many illegal packets, it repeatedly uses printk/print_hex_dump to dump packet content. With console output enabled, that logging path can consume enough CPU to cause soft lockup. The upstream fix limits these messages with the kernel net_ratelimit mechanism.

Likely exposure

Likely exposure is Linux systems on affected kernel lines where TUN and vhost_net paths process untrusted or malformed packets. The source bundle does not prove remote, unauthenticated reachability. Systems using TUN or vhost_net should be checked first.

Exploitation context

The CVE is not listed as KEV in the provided data and no supplied source reports active exploitation. The described impact is denial of service through excessive kernel logging. The sources do not establish attacker privileges, exploit maturity, or whether a default configuration is reachable.

Researcher notes

The root cause is log amplification in tun_do_read after illegal packet receipt through vhost/TUN callbacks. The fix direction is rate limiting, not a protocol parsing redesign. Missing evidence: CVSS, CWE, exact attacker position, and distro-specific package completeness beyond referenced advisories.

Mitigation direction

  • Apply vendor Linux kernel updates that include the CVE-2024-27013 stable fixes.
  • Prioritize systems using TUN, vhost_net, virtual networking, or related appliances.
  • Use distribution and product advisories to confirm supported patched package versions.
  • If patching is delayed, follow vendor guidance; the bundle names no separate workaround.
  • Keep console logging exposure under review on systems where availability is critical.

Validation and detection

  • Inventory Linux kernel versions against CVE-2024-27013 affected and fixed references.
  • Identify systems where TUN and vhost_net functionality is enabled or required.
  • Review kernel logs for soft lockup reports or repeated TUN illegal-packet dump messages.
  • Confirm installed kernel packages contain the referenced upstream stable fix.
  • Track applicable vendor advisories for environment-specific coverage.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-27013 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
16Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71, ef3db4a5954281bc1ea49a4739c88eaea091dc71unaffected
LinuxLinux2.6.35, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.