CVE-2024-57931

What it actually does

In SELinux extended permission evaluation, unknown permission types trigger a kernel BUG() instead of being silently ignored, causing a crash or denial of service on forward-incompatible policies.

Why it matters to the business

Systems using SELinux may experience unexpected kernel panics or instability when encountering policies or permission sets containing newer or unrecognized extended permissions, leading to downtime and availability issues; the low EPSS and lack of KEV listing indicate limited observed exploitation but the forward-compatibility flaw still requires prompt patching given Linux kernel prevalence.

How an attack unfolds

An attacker supplies or triggers a security policy containing unknown extended permissions during access-control evaluation; older kernels hit the BUG() path rather than ignoring the unknown entry, resulting in a kernel crash. Threat actors listed in related Linux kernel campaigns could chain this with other kernel flaws for denial-of-service or further exploitation.

How to fix it

Apply the upstream fix (commit f45a77dd24ae9ddb474303ec3975c376bd99fc51) or a later stable kernel; for listed Red Hat packages upgrade firefox to the exact fixed versions provided (0:45.2.0-1.el5_11, 0:45.2.0-1.el6_8, 0:45.2.0-1.el7_2) and reboot if the kernel or policy loader is affected.

How to confirm the fix worked

Confirm the running kernel contains commit f45a77dd24ae9ddb474303ec3975c376bd99fc51 or later; test by loading a policy with an unknown extended permission and verify no BUG() or panic occurs.

Typical attack path

1. Identify or craft a workload/policy that exercises SELinux extended permission checks
2. Introduce an unknown permission value into the permission bitmap or policy
3. Trigger permission evaluation on an unpatched kernel
4. Cause BUG() invocation leading to kernel panic or oops

How to detect it

Search kernel logs for SELinux-related BUG() or oops entries occurring during permission evaluation; review audit logs for policy loads containing extended permissions; correlate with any listed threat-actor activity involving Linux kernel resource or bounds issues.

What your security team should do

• Prioritize kernel updates on all SELinux-enabled systems within the next patching cycle
• Monitor for any policy authoring tools that may emit future permission values
• Review SELinux policy deployment processes to avoid introducing unknown permissions before kernels are updated