CVE-2024-57795 is a high-severity use-after-free vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically affecting the RXE (RDMA over Converged Ethernet) driver. The vulnerability arises due to improper handling of network device references within the kernel's infiniband software stack. The root cause is that an event (ib_cache_event_task) related to the infiniband cache is queued and executed after the associated network device (net_device) has been freed, leading to a use-after-free condition. This is evidenced by the KASAN (Kernel Address Sanitizer) slab-use-after-free error in the dev_get_flags function, which attempts to access freed memory. The issue was identified through kernel debugging and syzkaller fuzzing logs, showing a timeline where the event is queued, the device is freed, and then the event handler accesses the freed device, causing the crash. The vulnerability affects Linux kernel versions including the commit referenced (8700e3e7c4857d28ebaa824509934556da0b3e76). The CVSS v3.1 score is 7.8, indicating high severity, with an attack vector of local (AV:L), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Exploitation could allow a local attacker with limited privileges to cause kernel crashes (denial of service) or potentially escalate privileges by exploiting the use-after-free condition. The patch involves removing the direct link to net_device in the RXE driver to prevent stale references. No known exploits are reported in the wild yet, but the vulnerability is critical due to its potential impact on system stability and security.

For European organizations, this vulnerability poses a significant risk especially for those relying on Linux servers with RDMA capabilities, commonly used in high-performance computing, data centers, and cloud infrastructures. Exploitation could lead to kernel crashes causing denial of service, impacting availability of critical services. More seriously, the use-after-free flaw could be leveraged for privilege escalation, threatening confidentiality and integrity of sensitive data. Organizations running RDMA-enabled Linux kernels in production environments, including financial institutions, research centers, and cloud service providers, may face operational disruptions and increased risk of targeted attacks. Given the local attack vector, insider threats or compromised user accounts could exploit this vulnerability. The lack of user interaction requirement increases the risk of automated or scripted exploitation once local access is obtained. The vulnerability also affects virtualized environments using RDMA passthrough or similar technologies, which are prevalent in European cloud data centers, amplifying potential impact.

European organizations should promptly apply the official Linux kernel patches that remove the direct net_device references in the RXE driver to eliminate the use-after-free condition. Until patches are deployed, organizations should restrict local access to systems running vulnerable kernels, enforce strict privilege separation, and monitor for unusual kernel crashes or logs indicating use-after-free errors. Disabling RDMA or the RXE driver temporarily on non-critical systems can reduce exposure. Security teams should audit systems for the affected kernel versions and prioritize patching on servers with RDMA enabled. Additionally, implementing kernel live patching solutions where available can minimize downtime during remediation. Monitoring kernel logs for KASAN reports or related errors can help detect exploitation attempts. Finally, organizations should review and tighten access controls to limit local user privileges and prevent unauthorized code execution that could trigger this vulnerability.