CVE-2024-35827

What it actually does

Casting size_t controllen to int in io_recvmsg_mshot_prep allows negative values after cast to bypass check_add_overflow detection, since the destination type is int and negative values fit without triggering overflow.

Why it matters to the business

Local denial of service is possible on systems using io_uring for network operations, potentially disrupting availability; low exploitation likelihood and no ransomware use reported, though downstream dependents in the ecosystem increase patch urgency.

How an attack unfolds

A local attacker with access to the io_uring interface crafts recvmsg operations that cause the controllen cast to produce a negative value, bypassing the overflow check and leading to incorrect handling that results in a crash; listed threat actors associated with kernel issues provide context for monitoring.

How to fix it

Apply the kernel fix removing the unnecessary cast and correcting the overflow check logic; for listed affected products update to tomakehurst/wiremock (GIT) commit 7a5126498182fd1c5036128244ede631e790804e.

How to confirm the fix worked

Confirm the patch is present by inspecting the io_recvmsg_mshot_prep function for removal of the int cast on controllen and sizeof; test with crafted positive and boundary controllen values to verify overflow behavior.

Typical attack path

1. Gain local user access on an affected system
2. Invoke io_uring networking operations via recvmsg
3. Supply a controllen value that becomes negative when cast to int
4. Trigger the faulty check_add_overflow path to induce denial of service

How to detect it

Review kernel logs for io_uring related panics or oops following recvmsg calls; search audit logs for unusual io_uring submission patterns from untrusted processes; threat actor mentions for kernel RCE provide context for broader hunting.

What your security team should do

• Prioritize patching systems exposing io_uring to local users within the CISA-style remediation window if applicable
• Monitor EPSS trend stability and reassess if exploit maturity increases
• Restrict untrusted local access to io_uring interfaces via seccomp or capabilities where possible