CVE-2024-53137

What it actually does

The cacheflush syscall on ARM with PAN for LPAE fails to enable user access around cache maintenance instructions, resulting in faults instead of completing the operation.

Why it matters to the business

Systems may experience unexpected crashes or degraded performance during routine cache operations, increasing downtime risk especially on older kernel deployments with high downstream usage.

How an attack unfolds

An attacker invokes the cacheflush syscall on a vulnerable ARM system; without proper user access setup the cache maintenance instructions fault, allowing denial-of-service or potential escalation depending on context, consistent with patterns seen in recent espionage and financially motivated campaigns targeting Linux kernel issues.

How to fix it

Update to fixed kernel commit e6960a2ed49c9a25357817535f7cc50594a58604 or apply package updates such as quagga 0.99.22.4-3ubuntu1.2 on Ubuntu 14.04 LTS and 0.99.24.1-2ubuntu1.1 on Ubuntu 16.04 LTS; prioritize patching given stable EPSS and listed threat actor activity.

How to confirm the fix worked

Confirm kernel version or package matches a listed fixed release, then execute cacheflush operations in test workloads to verify no faults occur under PAN/LPAE configurations.

Typical attack path

1. Identify ARM Linux target running affected kernel version
2. Trigger cacheflush syscall via user-space application or library call
3. Observe resulting fault or crash due to missing user access enablement
4. Leverage resulting instability for further impact or service disruption

How to detect it

Search kernel logs and audit trails for cacheflush syscall faults or PAN-related access errors on ARM systems; correlate with process activity invoking cache maintenance around the publication date and threat actor campaigns mentioned.

What your security team should do

• Apply the referenced kernel commit or package updates immediately on all ARM systems
• Monitor EPSS and KEV status for any changes in exploit likelihood
• Review logs for cacheflush-related faults on exposed hosts
• Limit syscall exposure where possible until patches are deployed