CVE-2024-23849

What it actually does

Off-by-one error in RDS_MSG_RX_DGRAM_TRACE_MAX comparison in rds_recv_track_latency allows out-of-bounds memory access within the RDS subsystem of the Linux kernel.

Why it matters to the business

Local users on affected Linux systems can trigger denial of service, disrupting availability of networked applications relying on RDS; widespread kernel deployment increases operational risk across servers and embedded devices.

How an attack unfolds

An authenticated local attacker invokes RDS datagram operations that reach the flawed latency tracking function, supplying input that exceeds the intended boundary due to the off-by-one comparison and causes the out-of-bounds access leading to a crash.

How to fix it

Upgrade the Linux kernel to the commit 13e788deb7348cc88df34bed736c3b3b9927ea52 or any later mainline or distribution-patched version that corrects the RDS_MSG_RX_DGRAM_TRACE_MAX comparison.

How to confirm the fix worked

Verify the running kernel contains commit 13e788deb7348cc88df34bed736c3b3b9927ea52, inspect the source of net/rds/af_rds.c for the corrected comparison, or confirm the system no longer panics under the previously triggering RDS workload.

Typical attack path

1. Obtain local shell access on a vulnerable Linux host
2. Load or exercise the RDS protocol with crafted datagrams that trigger rds_recv_track_latency
3. Trigger the off-by-one boundary condition to perform out-of-bounds access
4. Cause kernel panic or system instability

How to detect it

Review kernel logs for oops or panic entries referencing rds_recv_track_latency or net/rds/af_rds.c; correlate with process activity involving RDS sockets.

What your security team should do

• Prioritize kernel updates on all systems exposing RDS or running recent 6.x kernels
• Apply the fix referenced by commit 13e788deb7348cc88df34bed736c3b3b9927ea52 across distributions
• Restrict untrusted local access until patches are deployed
• Monitor for kernel oops or panic events related to RDS