CVE-2024-50270

What it actually does

Integer overflow in damon_feed_loop_next_input() score_goal_diff_bp, compensation, and return value calculations when score is high or under-achieves the constant 10,000 goal, leading to incorrect or undefined DAMON loop input results in the Linux kernel.

Why it matters to the business

Potential instability or crashes in memory monitoring on Linux systems using DAMON, increasing operational risk for servers and devices with high ecosystem prevalence of the kernel component.

How an attack unfolds

An attacker supplies crafted high or low score values to trigger overflow paths in the function, resulting in memory corruption or denial of service; low observed exploitation activity despite mentions of espionage and financially motivated actors in broader Linux kernel campaigns.

How to fix it

Upgrade the Linux kernel to a patched version that includes the two corner-case handlers and rewritten overflow-safe body in damon_feed_loop_next_input(); for flashplugin-nonfree on Ubuntu 14.04 LTS apply version 11.2.202.554ubuntu0.14.04.1 where applicable.

How to confirm the fix worked

Confirm kernel source contains the added corner-case handling at function start and removal of bp-value calculations; test DAMON with boundary score values to verify no overflow occurs.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with DAMON enabled
2. Gain local access or influence over inputs to damon_feed_loop_next_input()
3. Trigger overflow conditions via high or under-achieving score values
4. Exploit resulting incorrect calculations for memory corruption or system impact

How to detect it

Review kernel logs and DAMON debug output for anomalous score calculations or repeated function calls; search system audit logs for unusual process interactions with memory monitoring subsystems in campaigns by listed threat actors.

What your security team should do

• Prioritize kernel updates on all systems using DAMON given 692 days since publication and steady EPSS
• Audit for DAMON usage in production workloads and apply fixed versions immediately
• Monitor threat actor activity around Linux kernel memory issues for emerging exploitation