CVE-2024-57843

What it actually does

A buffer overflow occurs in virtnet_rq_alloc when a single-page frag plus the 16-byte virtnet_rq_dma header exceeds PAGE_SIZE under net.core.high_order_alloc_disable=1, due to premapped mode changes in virtio_ring.

Why it matters to the business

Produces reliable virtual machine crashes and large file transfer failures over virtio networking, reducing availability for affected systems with minimal urgency given low EPSS and no KEV listing.

How an attack unfolds

Workloads or network activity trigger receive queue refills that allocate single-page fragments; the fixed-size DMA header then overflows the page boundary introduced by earlier premapped mode commits, leading to memory corruption and crashes.

How to fix it

Apply the upstream fix that reduces buffer length when frag size is insufficient; for chromium-browser on Ubuntu 14.04 LTS upgrade to version 58.0.3029.81-0ubuntu0.14.04.1172.

How to confirm the fix worked

Confirm updated kernel or package versions contain the buffer length reduction; retest large-file transfers such as 100 MB scp to the VM under high_order_alloc_disable=1.

Typical attack path

1. Encounter or set net.core.high_order_alloc_disable=1 on a virtio-net guest
2. Initiate network receive operations requiring frag refills
3. Allocate a single-page frag whose buffer plus virtnet_rq_dma exceeds PAGE_SIZE
4. Trigger the overflow during allocation resulting in crash or transfer failure

How to detect it

Review kernel logs and dmesg for oops or crashes referencing virtnet_rq_alloc or virtio-net receive queue DMA overflows after the 2025-01-11 publication date.

What your security team should do

• Upgrade affected kernels or packages to the listed fixed versions
• Monitor virtio-net receive path stability in virtualized environments
• Validate high_order_alloc_disable settings do not trigger the condition post-fix