CVE-2024-50271

What it actually does

The kernel unconditionally enforces UCOUNT_RLIMIT_SIGPENDING even when override_rlimit is set, causing sigqueue_alloc to fail for signals such as SIGSEGV and delivering them without siginfo.

Why it matters to the business

Java and other applications may crash or exhibit unpredictable behavior when signal limits are reached, leading to production outages and difficult-to-diagnose failures.

How an attack unfolds

An attacker or workload triggers a signal pending limit while forcing a faulting signal; the kernel drops siginfo, preventing correct fault handling and causing the target process to terminate or misbehave. Generic Linux kernel exploitation campaigns have been observed targeting similar signal and resource-accounting flaws.

How to fix it

Upgrade the Linux kernel to a version containing the override_rlimit restoration fix; for the listed flashplugin-nonfree packages on Ubuntu 14.04 LTS apply version 11.2.202.554ubuntu0.14.04.1 or later.

How to confirm the fix worked

Confirm the running kernel contains the commit that passes override_rlimit into inc_rlimit_get_ucounts(); test signal delivery under an exceeded RLIMIT_SIGPENDING with override enabled.

Typical attack path

1. Reach or approach RLIMIT_SIGPENDING for the target process
2. Induce a signal (e.g., SIGSEGV) that requires siginfo
3. Observe failed signal delivery and resulting application crash or undefined behavior

How to detect it

Review kernel logs and application crash reports for repeated SIGSEGV or other signals delivered without siginfo under high signal-pending counts; correlate with process resource limit settings.

What your security team should do

• Prioritize kernel updates on all production systems within the CISA-style remediation window if one is published
• Monitor EPSS and threat actor reports for any increase in exploitation of Linux kernel signal-handling issues
• Add kernel version checks to vulnerability scanning and asset inventory