CVE-2024-49856

What it actually does

Causes an indefinite while loop in the SGX NUMA node search when the current node lacks an EPC section configured by firmware and remote sections are exhausted, because nid_of_current is never set in sgx_numa_mask, resulting in a soft lockup.

Why it matters to the business

Leads to system instability, hangs, and potential denial of service on Linux systems using SGX in multi-NUMA-node environments without local EPC sections, increasing operational downtime risk especially given the vulnerability's presence in kernel code used across many deployments.

How an attack unfolds

An attacker triggers SGX memory allocation requests that exhaust EPC pages on nodes with sections configured, forcing the search loop to target the current SGX-lacking node that will never appear in the iteration, deadlocking the CPU; this aligns with observed patterns in 2024 zero-day campaigns by espionage and financially motivated actors targeting Linux kernel resource issues.

How to fix it

Apply the kernel patch resolving the SGX NUMA search logic or upgrade affected packages to activestorage (RubyGems) 6.1.7.7 where listed; ensure firmware SGX setup is validated across nodes and test in staging before production rollout given the extended time since publication.

How to confirm the fix worked

Confirm the loop rework starts and ends only on nodes with SGX memory present; verify no soft lockups occur under EPC exhaustion conditions on multi-node systems and check package versions match fixed releases.

Typical attack path

1. Map target Linux system NUMA topology and SGX EPC configuration via exposed interfaces
2. Exhaust available EPC pages on all nodes that have firmware-configured sections
3. Issue SGX allocation from a node lacking an EPC section
4. Enter the flawed search loop that never terminates
5. Trigger soft lockup and system unresponsiveness

How to detect it

Review kernel logs for soft lockup warnings mentioning SGX or NUMA node searches; inspect process traces showing indefinite loops in sgx_numa_mask handling and correlate with high CPU usage on affected nodes.

What your security team should do

• Prioritize patching all Linux kernel instances with SGX enabled within the next maintenance window
• Audit NUMA configurations for nodes without EPC sections and document acceptable setups
• Monitor EPSS trend stability and threat actor mentions for any uptick in exploitation
• Incorporate SGX-related deadlock tests into kernel regression suites