CVE-2024-49568

In the Linux kernel, the following vulnerability has been resolved:

net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen.

This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation is limited to causing a denial of service (system crash) on systems utilizing Shared Memory Communications, with no direct risk to data confidentiality or system integrity. The issue occurs during the connection negotiation phase when handling malformed proposal packets, which are only processed if SMC network sockets are actively utilized. Standard Red Hat Enterprise Linux deployments do not enable or rely on SMC sockets by default, substantially restricting exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.