CVE-2024-53210

What it actually does

Unbalanced socket buffer reference count increment without corresponding decrement when MSG_PEEK flag is passed to skb_recv_datagram in iucv_sock_recvmsg, resulting in skb memory leak during skb_queue_purge and WARN_ON in iucv_sock_destruct on socket close.

Why it matters to the business

Affected Linux kernels on s390 systems may experience gradual memory exhaustion during iucv socket operations, leading to performance degradation or crashes in high-usage environments; low EPSS and no KEV status indicate limited immediate risk but still requires attention for stability.

How an attack unfolds

An attacker interacts with iucv sockets by sending datagrams and invoking recvmsg with MSG_PEEK to increment skb refcount without decrement, repeating the action to accumulate leaks until memory pressure triggers warnings or denial of service; listed threat actors in Linux kernel campaigns could leverage similar patterns but this specific issue shows no active exploitation.

How to fix it

Apply kernel update containing commit 934326aef7ac4652f81c69d18bf44eebaefc39c3 which decrements skb refcount when MSG_PEEK is set; for listed Ubuntu libarchive packages upgrade to 3.1.2-7ubuntu2.3 or 3.1.2-11ubuntu0.16.04.2 as applicable.

How to confirm the fix worked

Reproduce with afiucv_test_msg tool and confirm absence of WARN_ON at net/iucv/af_iucv.c:286 in iucv_sock_destruct; inspect source for proper refcount handling and verify no memory leaks via slabinfo or kmemleak after socket close.

Typical attack path

1. Locate systems running vulnerable af_iucv kernel module on s390
2. Establish iucv socket and send datagrams
3. Call recvmsg with MSG_PEEK flag to trigger refcount imbalance
4. Repeat operations to induce memory leak
5. Observe kernel warnings or resource exhaustion

How to detect it

Search kernel logs and dmesg for strings referencing iucv_sock_destruct, af_iucv module, and skb refcount warnings; correlate with unusual memory growth in processes using iucv sockets.

• iucv_sock_destruct+0x144/0x1a0 [af_iucv]
• WARNING: CPU:.*at net/iucv/af_iucv.c:286
• afiucv_test_msg

What your security team should do

• Prioritize patching affected s390 kernels to the fixed commit
• Monitor system logs for iucv_sock_destruct warnings on production systems
• Restrict iucv socket exposure where feasible until updated