CVE-2024-50169

A flaw was found in the Linux kernel's vsock component. A local attacker can exploit an imbalance in the rx_bytes tracking mechanism, specifically after vsock_transport::read_skb() fails to update the received bytes count when a packet is dequeued. This can lead to a warning message indicating an empty receive queue with non-zero rx_bytes, potentially resulting in a denial of service (DoS) for the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the vsock kernel module from loading if it is not required. This can be achieved by blacklisting the module.

1. Create a new file /etc/modprobe.d/blacklist-vsock.conf with the following content:

   blacklist vsock
   

2. Regenerate the initramfs to ensure the blacklist is applied during boot: For RHEL 8 and 9:

   sudo dracut -f
   

   For RHEL 7:

   sudo dracut -f -v
   

3. Reboot the system for the changes to take effect.

Warning: Blacklisting the vsock module will disable inter-VM communication using vsock and may impact functionality that relies on it. A system reboot is required for the mitigation to be fully applied.