{
  "cveId": "CVE-2024-27061",
  "url": "https://patchblox.com/security/cve/CVE-2024-27061",
  "summary": "CVE-2024-27061 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-27061, released May 1, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: sun8i-ce - Fix use after free in unprepa...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  crypto: sun8i-ce - Fix use after free in unprepare  sun8i_ce_cipher_unprepare should be called before crypto_finalize_skcipher_request, because client callbacks may immediately free memory, that isn\u0027t needed anymore. But it will be used by unprepare after free. Before removing prepare/unprepare callbacks it was handled by crypto engine in crypto_finalize_request.  Usually that results in a pointer dereference problem during a in crypto selftest.  Unable to handle kernel NULL pointer dereference at                                       virtual address 0000000000000030  Mem abort info:    ESR = 0x0000000096000004    EC = 0x25: DABT (current EL), IL = 32 bits    SET = 0, FnV = 0    EA = 0, S1PTW = 0    FSC = 0x04: level 0 translation fault  Data abort info:    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000    CM = 0, WnR = 0, TnD = 0, TagAccess = 0    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0  user pgtable: 4k pages, 48-bit VAs, pgdp=000000004716d000  [0000000000000030] pgd=0000000000000000, p4d=0000000000000000  Internal error: Oops: 0000000096000004 [#1] SMP  This problem is detected by KASAN as well.  ==================================================================  BUG: KASAN: slab-use-after-free in sun8i_ce_cipher_do_one\u002B0x6e8/0xf80 [sun8i_ce]  Read of size 8 at addr ffff00000dcdc040 by task 1c15000.crypto-/373   Hardware name: Pine64 PinePhone (1.2) (DT)  Call trace:   dump_backtrace\u002B0x9c/0x128   show_stack\u002B0x20/0x38   dump_stack_lvl\u002B0x48/0x60   print_report\u002B0xf8/0x5d8   kasan_report\u002B0x90/0xd0   __asan_load8\u002B0x9c/0xc0   sun8i_ce_cipher_do_one\u002B0x6e8/0xf80 [sun8i_ce]   crypto_pump_work\u002B0x354/0x620 [crypto_engine]   kthread_worker_fn\u002B0x244/0x498   kthread\u002B0x168/0x178   ret_from_fork\u002B0x10/0x20   Allocated by task 379:   kasan_save_stack\u002B0x3c/0x68   kasan_set_track\u002B0x2c/0x40   kasan_save_alloc_info\u002B0x24/0x38   __kasan_kmalloc\u002B0xd4/0xd8   __kmalloc\u002B0x74/0x1d0   alg_test_skcipher\u002B0x90/0x1f0   alg_test\u002B0x24c/0x830   cryptomgr_test\u002B0x38/0x60   kthread\u002B0x168/0x178   ret_from_fork\u002B0x10/0x20   Freed by task 379:   kasan_save_stack\u002B0x3c/0x68   kasan_set_track\u002B0x2c/0x40   kasan_save_free_info\u002B0x38/0x60   __kasan_slab_free\u002B0x100/0x170   slab_free_freelist_hook\u002B0xd4/0x1e8   __kmem_cache_free\u002B0x15c/0x290   kfree\u002B0x74/0x100   kfree_sensitive\u002B0x80/0xb0   alg_test_skcipher\u002B0x12c/0x1f0   alg_test\u002B0x24c/0x830   cryptomgr_test\u002B0x38/0x60   kthread\u002B0x168/0x178   ret_from_fork\u002B0x10/0x20   The buggy address belongs to the object at ffff00000dcdc000   which belongs to the cache kmalloc-256 of size 256  The buggy address is located 64 bytes inside of   freed 256-byte region [ffff00000dcdc000, ffff00000dcdc100)",
  "published": "2024-05-01T13:15:50Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00228,
  "epssPercentile": 0.13663,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-27061",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-27061",
      "released": "2024-05-01T13:15:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.7.12-1",
      "fix": "DEBIAN-CVE-2024-27061",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-27061",
      "released": "2024-05-01T13:15:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}