Security readout for executives and security teams
Plain-English summary
A Linux SUNRPC error-handling bug can leave allocated credentials and option data in memory after certain decoding failures. Repeated triggering could consume kernel memory and affect service availability. The supplied 9.8 score claims broader compromise potential, but the cited technical description only establishes memory leaks.
Executive priority
Treat this as an urgent kernel-patching issue on systems where vendor guidance confirms exposure, especially SUNRPC-dependent infrastructure. Do not interpret the critical score as evidence of active compromise or proven code execution. Require vulnerability tooling to use distribution backport status rather than version-only comparisons.
Technical view
In gssx_dec_option_array, error paths after allocation failed to free creds and oa->data. Upstream stable commits add the missing deallocations. The available evidence supports a kernel memory leak; it does not explain how confidentiality or integrity compromise would occur despite the supplied CVSS vector.
Likely exposure
The bundle marks Linux releases across 3.10 through 6.9 as affected, but its flattened version data does not clearly express branch-specific fixed boundaries. Prioritize systems using SUNRPC/GSS functionality, then obtain definitive affected-package mappings from each Linux distribution or kernel vendor.
Exploitation context
The record is not listed as KEV, and no cited source reports active exploitation. The 9.8 vector describes unauthenticated network access and complete confidentiality, integrity, and availability impact, while the kernel description documents only memory leaks. This inconsistency materially limits exploitability conclusions.
Researcher notes
The fix frees creds and oa->data in allocation-related error handling. Multiple stable commits are supplied, but the bundle lacks a clear branch-to-fix mapping. Compare vendor backports using patch content or advisories rather than upstream version numbers alone. The source evidence does not substantiate the CVSS vector's complete confidentiality and integrity impacts.
Mitigation direction
- Apply the Linux vendor's kernel update containing the applicable stable fix for CVE-2024-27388.
- Reboot into the updated kernel; installing the package alone does not replace the running kernel.
- If updates are unavailable, consult the vendor for supported mitigations; none are named in the supplied sources.
Validation and detection
- Inventory running kernel versions and distribution builds across Linux assets.
- Confirm vendor advisories map each build to a fixed package or backported commit.
- After rebooting, verify the running kernel matches the remediated package.
- Review memory-pressure events, but do not treat their absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27388 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b97c37978ca825557d331c9012e0c1ddc0e42364CVE reference, Linux
- https://git.kernel.org/stable/c/bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8CVE reference, Linux
- https://git.kernel.org/stable/c/bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8CVE reference, Linux
- https://git.kernel.org/stable/c/dd292e884c649f9b1c18af0ec75ca90b390cd044CVE reference, Linux
- https://git.kernel.org/stable/c/934212a623cbab851848b6de377eb476718c3e4cCVE reference, Linux
- https://git.kernel.org/stable/c/5e6013ae2c8d420faea553d363935f65badd32c3CVE reference, Linux
- https://git.kernel.org/stable/c/9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4CVE reference, Linux
- https://git.kernel.org/stable/c/996997d1fb2126feda550d6adcedcbd94911fc69CVE reference, Linux
- https://git.kernel.org/stable/c/3cfcfc102a5e57b021b786a755a38935e357797dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.