CVE-2024-50258

What it actually does

Configures a small gso_max_size or gso_ipv4_max_size causing underflow in sk_dst_gso_max_size() that sets tso_segs to 0 and triggers BUG_ON(!tso_segs) during tcp_write_xmit via tcp_init_tso_segs and tcp_set_skb_tso_segs.

Why it matters to the business

Local denial-of-service crashes on systems allowing unprivileged configuration of GSO limits; low urgency given no KEV status, stable EPSS trend, and no ransomware association despite listed threat actor context.

How an attack unfolds

An attacker with local access configures an abnormally small gso_max_size or gso_ipv4_max_size value; subsequent TCP transmission through tcp_write_xmit computes zero tso_segs from large skb len and tiny mss_now, hitting the BUG_ON crash. No named APT groups have been observed exploiting this specific flaw.

How to fix it

Apply the kernel fix that adds minimum-value checks for gso_max_size and gso_ipv4_max_size. For the listed affected package update flashplugin-nonfree (Ubuntu:14.04:LTS) to 11.2.202.548ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the minimum-value guard is present in sk_dst_gso_max_size() and that gso_max_size/gso_ipv4_max_size cannot be set below device limits; test with small GSO values and verify no BUG_ON occurs.

Typical attack path

1. Obtain local user privileges on the target system
2. Set gso_max_size or gso_ipv4_max_size to a value smaller than device limits
3. Trigger TCP transmission that invokes tcp_write_xmit and tcp_init_tso_segs
4. Cause integer underflow resulting in tso_segs == 0 and kernel BUG_ON crash

How to detect it

Review kernel logs for BUG_ON messages referencing tcp_write_xmit or tso_segs; inspect sysctl changes to gso_max_size around the time of crashes; no specific threat-actor artifacts are known.

What your security team should do

• Prioritize kernel updates on all Linux systems that expose GSO configuration
• Restrict unprivileged users from modifying net.core.gso_max_size and related sysctls via SELinux or AppArmor policies
• Monitor for any future EPSS increase or KEV addition given the 702 days since publication