UBUNTU-CVE-2024-57903: XEE

Q: Which systems are exposed to this issue?

The issue applies to the listed Ubuntu Linux kernel packages, including the generic Ubuntu kernel and the AWS, Azure, GCP, Oracle, and FIPS variants. The vulnerable behavior involves non-inet sockets, such as crypto sockets, using the SO_REUSEPORT socket option.

Q: What access does an attacker need?

The supplied severity vector indicates local attack access with low privileges and no user interaction required. Exploitation requires the ability to interact with affected sockets locally.

Q: What is the likely impact?

The severity vector indicates high availability impact, with no indicated impact to confidentiality or integrity. The description identifies an invalid attempt to acquire a mutex from an RCU callback, which can trigger a kernel bug condition.

Q: What change addresses the problem?

The resolved kernel change restricts SO_REUSEPORT to inet sockets. TCP, UDP, SCTP, RAW, and ICMP support were retained, while the problematic use by crypto sockets is prevented.

Published Jan 15, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: net: restrict SOREUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1]. Trying to acquire a mutex in RCU callback is not allowed. Restrict SOREUSEPORT socket option to inet sockets. v1 of this patch supported TCP, UDP and SCTP sockets, but fcnal-test.sh test needed RAW and ICMP support. [1] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562 inatomic(): 1, irqsdisabled(): 0, nonblock: 0, pid: 24, name: ksoftirqd/1 preemptcount: 100, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by ksoftirqd/1/24: #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rculockacquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rcudobatch kernel/rcu/tree.c:2561 [inline] #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rcucore+0xa37/0x17a0 kernel/rcu/tree.c:2823 Preemption disabled at: [<ffffffff8161c8c8>] softirqhandlebegin kernel/softirq.c:402 [inline] [<ffffffff8161c8c8>] handlesoftirqs+0x128/0x9b0 kernel/softirq.c:537 CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 mightresched+0x5d4/0x780 kernel/sched/core.c:8758 mutexlockcommon kernel/locking/mutex.c:562 [inline] mutexlock+0x131/0xee0 kernel/locking/mutex.c:735 cryptoputdefaultnullskcipher+0x18/0x70 crypto/cryptonull.c:179 aeadrelease+0x3d/0x50 crypto/algifaead.c:489 algdorelease crypto/afalg.c:118 [inline] algsockdestruct+0x86/0xc0 crypto/afalg.c:502 skdestruct+0x58/0x5f0 net/core/sock.c:2260 rcudobatch kernel/rcu/tree.c:2567 [inline] rcucore+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handlesoftirqs+0x2d4/0x9b0 kernel/softirq.c:561 runksoftirqd+0xca/0x130 kernel/softirq.c:950 smpbootthreadfn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 </TASK>

Affected Software

194 affected componentsFixes available

ubuntu/linux-azure*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oracle*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-fips*

ubuntu/linux-aws-5.15<5.15.0-1080.87~20.04.1

5.15.0-1080.87~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1086.95~20.04.1

5.15.0-1086.95~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1081.90~20.04.1

5.15.0-1081.90~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-136.147~20.04.1

5.15.0-136.147~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1

5.15.0-1074.77~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1077.83~20.04.1

5.15.0-1077.83~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-135.146~20.04.1

5.15.0-135.146~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1077.83~20.04.1

5.15.0-1077.83~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1075.79~20.04.1

5.15.0-1075.79~20.04.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-intel-5.13*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1

5.15.0-1039.39~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-135.146

5.15.0-135.146

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1080.87

5.15.0-1080.87

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1029.31~22.04.1

6.8.0-1029.31~22.04.1

ubuntu/linux-azure<5.15.0-1084.93

5.15.0-1084.93

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1029.34~22.04.1

6.8.0-1029.34~22.04.1

ubuntu/linux-azure-fde<5.15.0-1084.93.1

5.15.0-1084.93.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1079.88

5.15.0-1079.88

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1030.32~22.04.1

6.8.0-1030.32~22.04.1

ubuntu/linux-gke<5.15.0-1077.83

5.15.0-1077.83

ubuntu/linux-gkeop<5.15.0-1062.70

5.15.0-1062.70

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-60.63~22.04.1

6.8.0-60.63~22.04.1

ubuntu/linux-ibm<5.15.0-1072.75

5.15.0-1072.75

ubuntu/linux-ibm-6.8<6.8.0-1026.26~22.04.1

6.8.0-1026.26~22.04.1

ubuntu/linux-intel-iot-realtime<5.15.0-1073.75

5.15.0-1073.75

ubuntu/linux-intel-iotg<5.15.0-1075.81

5.15.0-1075.81

ubuntu/linux-kvm<5.15.0-1076.81

5.15.0-1076.81

ubuntu/linux-lowlatency<5.15.0-135.146

5.15.0-135.146

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-60.63.1~22.04.1

6.8.0-60.63.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1074.75

5.15.0-1074.75

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1028.31~22.04.1

6.8.0-1028.31~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1033.33

5.15.0-1033.33

ubuntu/linux-nvidia-tegra-igx<5.15.0-1021.21

5.15.0-1021.21

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1077.83

5.15.0-1077.83

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1026.27~22.04.1

6.8.0-1026.27~22.04.1

ubuntu/linux-raspi<5.15.0-1074.77

5.15.0-1074.77

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-62.65~22.04.1

6.8.0-62.65~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1044.48

5.15.0-1044.48

ubuntu/linux-bluefield<5.15.0-1062.64

5.15.0-1062.64

ubuntu/linux-realtime<5.15.0-1080.88

5.15.0-1080.88

ubuntu/linux-realtime-6.8<6.8.1-1022.23~22.04.1

6.8.1-1022.23~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1080.87+fips1

5.15.0-1080.87+fips1

ubuntu/linux-azure-fips<5.15.0-1083.92+fips1

5.15.0-1083.92+fips1

ubuntu/linux-fips<5.15.0-135.146+fips1

5.15.0-135.146+fips1

ubuntu/linux-gcp-fips<5.15.0-1079.88+fips1

5.15.0-1079.88+fips1

ubuntu/linux<6.8.0-60.63

6.8.0-60.63

ubuntu/linux-aws<6.8.0-1029.31

6.8.0-1029.31

ubuntu/linux-azure<6.8.0-1029.34

6.8.0-1029.34

ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1

6.11.0-1012.12~24.04.1

ubuntu/linux-azure-nvidia<6.8.0-1016.17

6.8.0-1016.17

ubuntu/linux-gcp<6.8.0-1030.32

6.8.0-1030.32

ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1

6.11.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1025.29

6.8.0-1025.29

ubuntu/linux-gkeop<6.8.0-1012.14

6.8.0-1012.14

ubuntu/linux-hwe-6.11<6.11.0-21.21~24.04.1

6.11.0-21.21~24.04.1

ubuntu/linux-ibm<6.8.0-1026.26

6.8.0-1026.26

ubuntu/linux-lowlatency<6.8.0-60.63.1

6.8.0-60.63.1

ubuntu/linux-nvidia<6.8.0-1028.31

6.8.0-1028.31

ubuntu/linux-nvidia-6.11<6.11.0-1007.7

6.11.0-1007.7

ubuntu/linux-nvidia-lowlatency<6.8.0-1028.31.1

6.8.0-1028.31.1

ubuntu/linux-nvidia-tegra<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-oem-6.11<6.11.0-1017.17

6.11.0-1017.17

ubuntu/linux-oem-6.8<6.8.0-1028.28

6.8.0-1028.28

ubuntu/linux-oracle<6.8.0-1026.27

6.8.0-1026.27

ubuntu/linux-raspi<6.8.0-1028.32

6.8.0-1028.32

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv<6.8.0-60.63.1

6.8.0-60.63.1

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2023.24

6.8.0-2023.24

ubuntu/linux-realtime<6.8.1-1022.23

6.8.1-1022.23

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.87~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.95~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.90~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-136.147~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.77~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-135.146~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.79~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1039.39~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-135.146
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.87
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.31~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.93
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.34~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.93.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.88
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.32~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1062.70
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-60.63~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1072.75
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.26~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1073.75
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.81
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.81
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-135.146
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-60.63.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.75
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.31~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.33
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.21
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1077.83
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.27~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.77
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-62.65~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.48
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1062.64
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.88
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1022.23~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.87+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.92+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-135.146+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.88+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-60.63
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.31
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.34
Upgrade
Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.32
Upgrade
Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.29
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1012.14
Upgrade
Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-21.21~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.26
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-60.63.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.31
Upgrade
Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1007.7
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.31.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.28
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.27
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.32
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-60.63.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2023.24
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1022.23
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1
Configuration
Restrict the SO_REUSEPORT socket option to inet sockets; support TCP, UDP, SCTP, RAW, and ICMP sockets as required by fcnal-test.sh.
Linux kernel socket layer SO_REUSEPORT = restricted to inet sockets

Event History

Jan 15, 2025

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue applies to the listed Ubuntu Linux kernel packages, including the generic Ubuntu kernel and the AWS, Azure, GCP, Oracle, and FIPS variants. The vulnerable behavior involves non-inet sockets, such as crypto sockets, using the SO_REUSEPORT socket option.

What access does an attacker need?

The supplied severity vector indicates local attack access with low privileges and no user interaction required. Exploitation requires the ability to interact with affected sockets locally.

What is the likely impact?

The severity vector indicates high availability impact, with no indicated impact to confidentiality or integrity. The description identifies an invalid attempt to acquire a mutex from an RCU callback, which can trigger a kernel bug condition.

What change addresses the problem?

The resolved kernel change restricts SO_REUSEPORT to inet sockets. TCP, UDP, SCTP, RAW, and ICMP support were retained, while the problematic use by crypto sockets is prevented.

UBUNTU-CVE-2024-57903: XEE

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need?

What is the likely impact?

What change addresses the problem?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need?

What is the likely impact?

What change addresses the problem?