CVE-2024-56783

What it actually does

The vulnerability allows userspace processes to reach and trigger a WARN_ON_ONCE in the nft_socket netfilter handler by setting cgroup maximum depth to its default INT_MAX value without triggering the performance-restricting toggle.

Why it matters to the business

Local users on affected Linux kernels can generate kernel warnings that may lead to log spam or minor operational noise; organizations running large numbers of Linux systems or dependent packages face routine patching requirements to eliminate the reachable warning path.

How an attack unfolds

A local attacker configures a cgroup hierarchy to its maximum depth, then sends crafted netfilter nft_socket requests that exercise the depth check, causing the kernel to hit the WARN_ON_ONCE that was reachable from userspace.

How to fix it

Upgrade the Linux kernel to version 6.1.120 or newer. On Ubuntu 14.04 LTS systems also update chromium-browser to 58.0.3029.81-0ubuntu0.14.04.1172.

How to confirm the fix worked

Confirm the running kernel reports version 6.1.120 or later; inspect the nft_socket source to verify the WARN_ON_ONCE on cgroup depth has been removed; test that high-depth cgroup configurations no longer emit the warning.

Typical attack path

1. Obtain local shell or process execution on a Linux host
2. Create or modify a cgroup with depth approaching INT_MAX
3. Issue netfilter nft_socket operations that traverse the cgroup depth check
4. Trigger the WARN_ON_ONCE and observe resulting kernel log activity

How to detect it

Search kernel logs for nft_socket-related WARN_ON_ONCE entries mentioning cgroup levels; correlate with processes that manipulate cgroups or netfilter rules.

What your security team should do

• Apply the kernel update to 6.1.120 across all Linux fleets within standard change windows
• Review and restrict unnecessary cgroup depth configurations where possible
• Add kernel version checks to vulnerability scanning and asset inventory processes