CVE-2024-49571

What it actually does

The flaw allows an untrusted remote client to supply an out-of-bounds iparea_offset or ipv6_prefixes_cnt value in an SMC proposal message, resulting in invalid memory access and potential kernel crash in the net/smc receive path.

Why it matters to the business

Systems relying on SMC over RDMA may experience denial-of-service crashes that interrupt high-performance networking and clustered workloads; low EPSS and no KEV status indicate limited real-world exploitation risk.

How an attack unfolds

An attacker establishes an SMC connection and sends a crafted proposal message containing an excessively large iparea_offset that bypasses prior bounds checks, causing the server kernel to dereference an invalid address.

How to fix it

Apply the kernel patch referenced by commit 846bada23bfcdeb83621b045ed85dc06c7833ff0 that adds validation of iparea_offset and ipv6_prefixes_cnt before use; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains the validation checks for iparea_offset and ipv6_prefixes_cnt; review dmesg or kernel logs for absence of SMC-related oops after applying the update.

Typical attack path

1. Initiate SMC handshake from a remote client
2. Transmit proposal message with malicious iparea_offset
3. Trigger out-of-bounds access during message processing
4. Induce kernel panic or crash on the target system

How to detect it

Inspect kernel logs and dmesg for SMC module oops or panic entries; review network captures for anomalous SMC proposal messages with unusually large offset fields.

What your security team should do

• Prioritize kernel upgrades containing the SMC input validation fix
• Disable SMC/RDMA interfaces where not required to reduce attack surface
• Monitor kernel crash reports for net/smc module panics