CVE-2024-57791

What it actually does

The flaw permits an infinite loop (deadloop) in smc_clc_wait_msg when the untrusted length field from a network CLC message exceeds buflen, because sock_recvmsg return values are not checked while draining excess data.

Why it matters to the business

Attackers can trigger resource exhaustion or system unresponsiveness on affected hosts, causing service outages and requiring manual intervention to recover.

How an attack unfolds

An attacker crafts and sends a CLC message containing an oversized length value; the kernel enters the draining loop in smc_clc_wait_msg and never exits because sock_recvmsg errors are ignored, leading to sustained high CPU or hang. Threat actor campaigns have targeted similar Linux kernel networking issues for espionage and financial gain.

How to fix it

Upgrade chromium-browser on Ubuntu 14.04 LTS to version 58.0.3029.81-0ubuntu0.14.04.1172 or later; apply equivalent kernel patches that add return-value checks for sock_recvmsg in the SMC CLC drain path.

How to confirm the fix worked

Confirm package version matches or exceeds the listed fixed release; review kernel source for the sock_recvmsg return check in net/smc; attempt to reproduce with oversized length messages in a test environment to verify loop termination.

Typical attack path

1. Establish a connection that triggers CLC message reception
2. Transmit a crafted smc_clc_msg_hdr with length exceeding the local buffer
3. Force repeated sock_recvmsg calls in the drain logic
4. Induce deadloop resulting in denial of service

How to detect it

Inspect system and kernel logs for repeated network receive operations or high CPU in SMC-related code paths; correlate with network traffic showing anomalous CLC message lengths from external sources.

What your security team should do

• Apply the listed fixed package versions immediately given the 638 days since publication
• Prioritize updates on any systems exposing SMC or network-facing kernel paths
• Monitor EPSS trend and block untrusted network sources that could send crafted CLC messages