CVE-2024-57791: net/smc: check return value of sock_recvmsg when draining clc data
In the Linux kernel, the following vulnerability has been resolved:
net/smc: check return value of sockrecvmsg when draining clc data
When receiving clc msg, the field length in smcclcmsghdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smcclcwaitmsg it may run into deadloop when trying to drain the remaining data exceeding buflen.
This patch checks the return value of sockrecvmsg when draining data in case of deadloop in draining.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57791?
The severity of CVE-2024-57791 is classified based on its impact on the Linux kernel's handling of socket messages.
How do I fix CVE-2024-57791?
To fix CVE-2024-57791, you should update your Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2024-57791?
CVE-2024-57791 affects the Linux kernel used in various Linux distributions.
What type of vulnerability is CVE-2024-57791?
CVE-2024-57791 is a vulnerability related to improper handling of socket message reception in the Linux kernel.
Is there a workaround for CVE-2024-57791?
Currently, the recommended approach for CVE-2024-57791 is to apply the relevant updates rather than relying on a workaround.