CVE-2024-27061 is a use-after-free vulnerability identified in the Linux kernel's crypto subsystem, specifically within the sun8i-ce hardware crypto engine driver. The flaw arises due to an improper sequence of function calls where sun8i_ce_cipher_unprepare is invoked after crypto_finalize_skcipher_request, leading to a scenario where client callbacks may free memory that is subsequently accessed by the unprepare function. This results in a use-after-free condition, causing a kernel NULL pointer dereference and potential memory corruption. The vulnerability is detected by Kernel Address Sanitizer (KASAN), which reports slab-use-after-free errors during cryptographic self-tests. The issue manifests as a kernel oops and can cause system instability or crashes. The detailed kernel logs indicate that the problem occurs on ARM-based hardware such as the Pine64 PinePhone, but the underlying flaw exists in the Linux kernel's crypto engine handling of prepare/unprepare callbacks. This vulnerability is rooted in the crypto engine's lifecycle management of cryptographic requests, where the removal of prepare/unprepare callbacks shifted responsibility to crypto_finalize_request, but the sun8i-ce driver did not correctly adapt to this change, leading to unsafe memory access. No known exploits are reported in the wild at this time, and the vulnerability was publicly disclosed in May 2024 without an assigned CVSS score.

For European organizations, the impact of CVE-2024-27061 primarily concerns systems running Linux kernels that include the vulnerable sun8i-ce crypto engine driver. This is particularly relevant for embedded devices, ARM-based systems, and specialized hardware using this crypto engine, such as certain IoT devices, mobile phones (e.g., Pine64 PinePhone), and industrial equipment. Exploitation could lead to kernel crashes, denial of service, and potentially privilege escalation if attackers can leverage the use-after-free to execute arbitrary code in kernel space. While the vulnerability currently appears to be triggered during cryptographic self-tests, a crafted attack could potentially exploit this flaw to disrupt critical services or compromise device integrity. European sectors relying on embedded Linux systems in telecommunications, manufacturing, or critical infrastructure could face operational disruptions. However, the scope is limited to devices with the affected crypto engine, reducing the broad impact on general-purpose Linux servers or desktops. The absence of known exploits and the technical complexity of triggering the flaw also mitigate immediate widespread risk.

To mitigate CVE-2024-27061, European organizations should: 1) Identify and inventory all Linux-based devices, especially ARM-based embedded systems, that utilize the sun8i-ce crypto engine or similar hardware accelerators. 2) Apply the official Linux kernel patches that fix the use-after-free condition as soon as they become available from trusted Linux kernel sources or device vendors. 3) For devices where kernel updates are not immediately feasible, consider disabling the sun8i-ce crypto engine module if it is not critical to device operation, to prevent triggering the vulnerable code path. 4) Implement strict access controls and monitoring on devices running vulnerable kernels to detect abnormal kernel crashes or oops events that may indicate exploitation attempts. 5) Engage with hardware and device manufacturers to ensure timely firmware and kernel updates are provided and deployed. 6) Incorporate this vulnerability into vulnerability management and incident response plans, focusing on embedded and ARM-based Linux device fleets. 7) Conduct targeted testing and fuzzing of cryptographic operations on affected devices to detect potential exploitation attempts or stability issues.