Linux Kernel Vulnerability in Receive Handling of CLC Messages by Vendor

CVE-2024-57791

Summary

A vulnerability has been identified in the Linux kernel related to the handling of CLC messages during network operations. Specifically, the length of the message received from the network may not be fully trusted, potentially leading to a scenario where the expected length exceeds the buffer size. This situation can cause the process to enter a deadloop while attempting to drain the excess data. The recent patch adds checks to the return value of sock_recvmsg, improving the robustness of the data draining process and mitigating the risk of deadloops.

References