CVE-2024-53175

What it actually does

Unreleased percpu memory allocations for mq sysctls and ipc sysctls when msg_init_ns fails during create_ipc_ns, causing a memory leak of kernel objects.

Why it matters to the business

Gradual memory exhaustion on systems frequently creating IPC namespaces such as container hosts, raising operational costs and potential service disruption risk over extended periods; low immediate urgency due to absent KEV status and stable low EPSS.

How an attack unfolds

An attacker invokes namespace creation paths via clone or unshare system calls that reach copy_ipcs and setup_mq_sysctls; when percpu allocation fails the error path skips release of prior sysctl allocations, leaving unreferenced kernel memory.

How to fix it

Apply the kernel patch that releases ipc and mq sysctls on msg_init_ns failure; for affected flashplugin-nonfree (Ubuntu:14.04:LTS) install fixed package version 11.2.202.632ubuntu0.14.04.1.

How to confirm the fix worked

Confirm kernel source contains the corrected error path in create_ipc_ns; run kmemleak or slabinfo checks after repeated namespace creation to verify no new unreferenced objects of the reported type.

Typical attack path

1. Invoke clone/unshare to trigger namespace duplication
2. Reach create_new_namespaces and copy_ipcs
3. Force percpu allocation failure inside setup_mq_sysctls or msg_init_ns
4. Observe unreleased sysctl objects in kernel memory

How to detect it

Search kernel logs and kmemleak reports for unreferenced objects with backtraces containing setup_mq_sysctls, copy_ipcs, or create_new_namespaces; inspect slab usage after high rates of namespace cloning.

What your security team should do

• Prioritize kernel updates on container orchestration hosts and multi-tenant systems
• Monitor EPSS and CISA KEV for any future elevation
• Audit custom namespace creation workloads for allocation failure handling