CVE-2024-50178

What it actually does

Incorrect use of smp_processor_id() inside preemptible context in the loongson3 cpufreq driver triggers kernel BUG warnings and potential instability when the driver is loaded.

Why it matters to the business

Systems using affected Loongson hardware may experience unexpected driver errors or reduced availability during normal operation; the listed qemu packages on old Ubuntu releases require updates to maintain platform stability.

How an attack unfolds

An attacker with local access loads or triggers the loongson3_cpufreq driver under conditions where the process is preemptible, causing the kernel to hit the BUG check; listed threat actors have targeted similar kernel resource-handling flaws in recent campaigns.

How to fix it

Update to the fixed qemu package versions 2.0.0+dfsg-2ubuntu1.21 (or newer) on Ubuntu 14.04 LTS; rebuild and deploy kernels containing the raw_smp_processor_id() change for Loongson3 platforms.

How to confirm the fix worked

Verify the installed package version matches or exceeds the listed fixed release; confirm absence of the smp_processor_id() call in do_service_request() via source inspection or kernel symbol checks after reboot.

Typical attack path

1. Obtain local user access on a vulnerable Loongson-based system
2. Load or interact with the loongson3 cpufreq module
3. Trigger scheduling that makes the calling context preemptible
4. Observe kernel BUG and potential denial of service

How to detect it

Search kernel logs and dmesg for BUG messages referencing smp_processor_id and loongson3_cpufreq_probe; review module load events around the time of any reported instability.

What your security team should do

• Prioritize patching Ubuntu 14.04 qemu packages within the next maintenance window
• Monitor kernel logs for 'using smp_processor_id() in preemptible' messages on Loongson systems
• Disable the loongson3_cpufreq driver if immediate patching is not feasible