CVE-2024-57791

In the Linux kernel, the following vulnerability has been resolved:

net/smc: check return value of sock_recvmsg when draining clc data

When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen.

This patch checks the return value of sock_recvmsg when draining data in case of deadloop in draining.

This vulnerability is rated Moderate by Red Hat because exploitation requires an active Shared Memory Communications (SMC) socket link and results strictly in a denial of service without compromising data confidentiality or system integrity. In default Red Hat Enterprise Linux installations, the SMC protocol is not enabled or utilized by standard network workloads, which significantly restricts real-world exposure. Systems are only vulnerable if an attacker or rogue peer can establish an SMC connection and transmit a malformed handshake message to induce an infinite draining loop in the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.