CVE-2024-53119

A flaw was found in the Linux kernel's virtio/vsock subsystem. Due to a race condition during socket destruction, incoming connection requests can be added to the queue after it has already been cleared, leaving unreleased sockets in memory. A local attacker could exploit this timing issue to cause a kernel memory leak, potentially exhausting system resources and leading to a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Summary: Prevent the vsock and vmw_vsock_virtio_transport kernel modules from loading if virtual socket communication is not required.

Command Instructions:

1. Create a configuration file to prevent loading the modules:

echo "install vsock /bin/true" > /etc/modprobe.d/disable-vsock.conf
echo "install vmw_vsock_virtio_transport /bin/true" >> /etc/modprobe.d/disable-vsock.conf

2. Unload the modules from the running system if currently loaded and not in use:

modprobe -r vmw_vsock_virtio_transport vsock

Caveats: Disabling these modules halts virtual socket communication (AF_VSOCK) between the host hypervisor and virtual machines. Virtualization features, guest agents, and container utilities that rely on VSOCK will fail to operate.

Warning: If the modules are in active use and cannot be unloaded dynamically, a system reboot is required for the configuration to take effect.