CVE-2024-53117

A flaw was found in the Linux kernel's virtio virtual socket (vsock) implementation. This vulnerability can lead to a Denial of Service (DoS) caused by memory exhaustion. When an error occurs during zero-copy network transmissions (MSG_ZEROCOPY), the kernel fails to properly release allocated socket memory buffers. A local user can exploit this flaw by repeatedly triggering transmission errors, resulting in a memory leak that can degrade performance or render the system unresponsive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the virtio vsock kernel module from loading if virtual socket communication between the host and virtual machine guests is not needed.

To prevent the module from loading, create a configuration file in /etc/modprobe.d/:

echo "install vmw_vsock_virtio_transport /bin/true" >> /etc/modprobe.d/disable-vsock.conf

Alternatively, disable the core vsock module if no VSOCK functionality is required:

echo "install vsock /bin/true" >> /etc/modprobe.d/disable-vsock.conf

Caveat: Disabling these modules prevents virtual machine guest-host inter-process communication relying on AF_VSOCK.

Warning: If the module is currently loaded into kernel memory, a system restart is required for the change to take full effect.