CVE-2024-53091

What it actually does

Missing socket type validation (sk_is_inet and IS_ICSK checks) in tls_sw_has_ctx_tx/rx allows vsock_sock or unix_sock structures to reach tls_get_ctx, resulting in invalid pointer dereference and page fault in sk_psock_strp_data_ready.

Why it matters to the business

Kernel crashes or service disruptions on systems handling vsock/unix sockets with TLS/sockmap, leading to availability loss; high downstream prevalence increases exposure across Linux environments.

How an attack unfolds

Attacker supplies vsock or unix domain socket traffic that reaches tls_sw_ctx_rx without proper type checks, triggering page fault during virtio_transport_recv_pkt or vsock_loopback_work processing; observed in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Linux kernel out-of-bounds access campaigns.

How to fix it

Apply kernel fixes addressing the missing checks; for listed packages upgrade samba (Ubuntu:18.04:LTS) to 2:4.7.6+dfsg~ubuntu-0ubuntu2.26.

How to confirm the fix worked

Confirm updated kernel or package versions contain the sk_is_inet/IS_ICSK guards; reproduce vsock_loopback_work traffic and verify absence of page fault at address 0000000000040030.

Typical attack path

1. Establish vsock or AF_UNIX socket connection to target
2. Trigger sockmap/TLS path that omits IS_ICSK validation
3. Force tls_get_ctx to return invalid pointer
4. Cause page fault in sk_psock_strp_data_ready during packet processing

How to detect it

Search kernel logs and dmesg for page fault traces involving sk_psock_strp_data_ready, virtio_transport_recv_pkt, and vsock_loopback_work; correlate with threat actor TTPs for Linux kernel resource and bounds issues.

• sk_psock_strp_data_ready+0x23/0x60
• BUG: unable to handle page fault for address: 0000000000040030
• Workqueue: vsock-loopback vsock_loopback_work
• RIP: 0010:sk_psock_strp_data_ready

What your security team should do

• Patch affected kernels immediately given publication date and threat actor activity
• Audit systems for vsock/unix socket + TLS/sockmap usage
• Enable kernel page fault and oops logging for rapid detection