CVE-2024-27013

In the Linux kernel, the following vulnerability has been resolved:

tun: limit printing rate when illegal packet received by tun dev

The Linux kernel CVE team has assigned CVE-2024-27013 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050149-CVE-2024-27013-2c26@gregkh/T

This vulnerability is rated with Low severity for Red Hat Enterprise Linux because exploitation requires local access or a guest environment to inject malformed network traffic into a virtual network interface, resulting only in excessive logging that can trigger a temporary CPU soft lockup rather than code execution or privilege escalation. Under standard enterprise deployments, triggering the condition requires active serial or verbose console logging alongside an uninterrupted stream of invalid frames. Furthermore, the issue is confined to environments utilizing TUN/TAP interfaces or vhost virtualization workers, restricting its impact to localized CPU starvation without compromising host confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.