CVE-2024-49979

What it actually does

Invalid TCP GSO fraglist SKB geometry after datapath modifications (NAT, BPF) triggers NULL pointer dereference in __tcpv4_gso_segment_list_csum during segmentation.

Why it matters to the business

Local denial of service on systems processing network traffic through containers or virtualized environments can interrupt workloads and require reboots, with elevated urgency for organizations running affected Rocky Linux 8 container tooling due to high ecosystem prevalence.

How an attack unfolds

An attacker with local access crafts or manipulates SKBs via BPF or NAT hooks to pull all data into linear space, violating fraglist invariants; the kernel then passes the corrupted SKB to skb_segment_list instead of skb_segment, dereferencing a NULL tcp header and crashing the system. Threat actors in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors have targeted similar Linux kernel memory issues.

How to fix it

Update the Linux kernel to commit 3fdd8c83e83fa5e82f1b5585245c51e0355c9f46 or later. For Rocky Linux 8 deployments apply the listed fixed package versions: fuse-overlayfs 0:1.4.0-3.module+el8.4.0+556+40122d08, containernetworking-plugins 0:0.9.1-1.module+el8.7.0+1076+9b1c11c1, runc 0:1.0.0-73.rc93.module+el8.4.0+556+40122d08, podman 0:3.0.1-7.module+el8.4.0+556+40122d08 and equivalent updates for skopeo, buildah, criu, crun, conmon, slirp4netns, libslirp and related container packages.

How to confirm the fix worked

Verify kernel version contains commit 3fdd8c83e83fa5e82f1b5585245c51e0355c9f46; confirm package versions match the fixed module tags; test with synthetic SKBs that exercise pull operations on GSO fraglist traffic.

Typical attack path

1. Obtain local code execution on affected Linux host
2. Install or trigger BPF program or NAT rule that calls bpf_skb_pull_data on TCP GSO fraglist SKBs
3. Force packet processing that hits the corrupted geometry check failure
4. Trigger segmentation path leading to NULL dereference in checksum routine
5. Cause kernel panic or system hang

How to detect it

Review kernel logs for NULL pointer dereference in __tcpv4_gso_segment_list_csum or tcp_hdr(seg->next); correlate with preceding BPF or netfilter activity on GSO-enabled TCP flows. Threat actor mentions of Linux Kernel Out-of-Bounds Read/Write vulnerabilities can guide broader kernel crash log searches.

What your security team should do

• Prioritize kernel and container runtime updates on all Rocky Linux 8 hosts within the CISA-style remediation window if applicable
• Restrict untrusted BPF programs and limit CAP_NET_ADMIN where possible
• Monitor for container-orchestrated traffic anomalies that could exercise the GSO path
• Plan staged rollout of fixed packages across buildah, podman, and runc fleets