CVE-2024-49568
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the net/smc module when receiving proposal messages on the server, the fields v2_ext_offset, eid_cnt, and ism_gid_cnt come from the remote client and are not fully trusted. Invalid values can lead to accessing wrong addresses and crashes. The fix adds checks for these fields before use.
Risk Assessment
A remote attacker could send a crafted proposal message causing server crash (DoS) or potentially exploit the flaw for other purposes.
Recommendation
Update the Linux kernel to a patched version. Also limit trust in network-incoming data.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them.