CVE-2024-42246

What it actually does

In the Linux kernel sunrpc module, xs_tcp_setup_socket enters an infinite loop when kernel_connect returns -EPERM due to an attached BPF program instead of remapping the error to ECONNREFUSED or similar, leading to rapid syslog growth and potential kernel freeze.

Why it matters to the business

Systems may experience log flooding and kernel hangs that disrupt network services and require reboots; prevalence in Linux distributions and tuned packages increases operational risk for servers handling RPC traffic.

How an attack unfolds

A local attacker deploys a BPF program on kernel_connect that forces an EPERM return during xs_tcp_setup_socket execution in sunrpc TCP handling; the unhandled error triggers the loop without propagating to higher layers that could recover, as noted in the fix commit bc790261218952635f846aaf90bcc0974f6f62c6.

How to fix it

Upgrade the Linux kernel to commit bc790261218952635f846aaf90bcc0974f6f62c6 or later; for AlmaLinux 8 packages update tuned-gtk, tuned-utils, and tuned-utils-systemtap to 2.16.0-1.el8.

How to confirm the fix worked

Verify the running kernel contains commit bc790261218952635f846aaf90bcc0974f6f62c6; confirm tuned packages are at version 2.16.0-1.el8 or newer; test sunrpc TCP setup with BPF programs attached to kernel_connect.

Typical attack path

1. Obtain local user privileges on an affected Linux system
2. Attach a BPF program to kernel_connect that returns -EPERM
3. Trigger sunrpc TCP connection setup via xs_tcp_setup_socket
4. Observe infinite loop causing syslog spam and potential freeze

How to detect it

Review kernel logs for repeated xs_tcp_setup_socket errors or EPERM handling in sunrpc; correlate with BPF program activity and sudden syslog growth preceding freezes.

What your security team should do

• Apply kernel and tuned package updates immediately on all affected systems
• Audit environments for custom BPF programs attached to kernel_connect
• Monitor for kernel-related hangs or excessive sunrpc logging pending patch deployment