Security readout for executives and security teams
Plain-English summary
A flaw in the Linux FireWire nosy packet-capture path could place more packet data into a user-provided buffer than requested. A locally authenticated user may be able to trigger serious confidentiality, integrity, or availability impact. Exposure depends on the affected kernel code being present and accessible.
Executive priority
Treat as a high-priority endpoint and server patching issue where affected FireWire functionality is exposed to local users. Accelerate remediation on shared or multi-user systems. Internet-facing status alone does not increase exposure because the documented attack vector is local.
Technical view
The kernel's packet_buffer_get function did not respect user_length when fetching the head packet. If that packet exceeded the supplied length, data could overflow the user-space buffer. The fix returns zero, indicating that no data was read and a larger buffer is required. CVSS 3.1 is 7.8 with local, low-privilege access.
Likely exposure
Prioritize Linux systems running affected kernel builds where the FireWire nosy functionality is available to untrusted local users. Remote-only services are not directly implicated by the supplied evidence. The listed version data is unusually broad and includes commit identifiers, so confirm exposure against distribution advisories and the deployed kernel package.
Exploitation context
The CVSS vector requires local access and low privileges, without user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Exploitability remains conditional on access to the affected functionality.
Researcher notes
No CWE is supplied. The version list mixes releases and repeated commit identifiers, limiting precise range interpretation. The core security boundary is enforcement of user_length before copying the head packet. The bundle supports a local buffer-overflow condition and upstream fixes, but does not establish practical exploit reliability or exploitation in the wild.
Mitigation direction
- Install a distribution-supported kernel update containing the referenced upstream fix.
- Reboot into the updated kernel and confirm the running version changed.
- Until updated, restrict untrusted local access to FireWire nosy functionality.
- Consult Linux distribution guidance for exact fixed package versions.
Validation and detection
- Record the running kernel version and distribution package release.
- Compare the package against applicable Debian, Fedora, or vendor advisories.
- Determine whether FireWire nosy support is built, loaded, and accessible.
- Confirm the deployed kernel contains the applicable upstream fix.
- Verify oversized packets are rejected when the supplied user buffer is smaller.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27401 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/67f34f093c0f7bf33f5b4ae64d3d695a3b978285CVE reference, Linux
- https://git.kernel.org/stable/c/7b8c7bd2296e95b38a6ff346242356a2e7190239CVE reference, Linux
- https://git.kernel.org/stable/c/cca330c59c54207567a648357835f59df9a286bbCVE reference, Linux
- https://git.kernel.org/stable/c/79f988d3ffc1aa778fc5181bdfab312e57956c6bCVE reference, Linux
- https://git.kernel.org/stable/c/4ee0941da10e8fdcdb34756b877efd3282594c1fCVE reference, Linux
- https://git.kernel.org/stable/c/1fe60ee709436550f8cfbab01295936b868d5baaCVE reference, Linux
- https://git.kernel.org/stable/c/539d51ac48bcfcfa1b3d4a85f8df92fa22c1d41cCVE reference, Linux
- https://git.kernel.org/stable/c/38762a0763c10c24a4915feee722d7aa6e73eb98CVE reference, Linux
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/CVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/CVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.