Linux Kernel Signal Handling Resource Limit Bypass Vulnerability
CVE-2024-50271 Published on November 19, 2024
signal: restore the override_rlimit logic
In the Linux kernel, the following vulnerability has been resolved:
signal: restore the override_rlimit logic
Prior to commit d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of
ucounts") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of
signals. However now it's enforced unconditionally, even if
override_rlimit is set. This behavior change caused production issues.
For example, if the limit is reached and a process receives a SIGSEGV
signal, sigqueue_alloc fails to allocate the necessary resources for the
signal delivery, preventing the signal from being delivered with siginfo.
This prevents the process from correctly identifying the fault address and
handling the error. From the user-space perspective, applications are
unaware that the limit has been reached and that the siginfo is
effectively 'corrupted'. This can lead to unpredictable behavior and
crashes, as we observed with java applications.
Fix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip
the comparison to max there if override_rlimit is set. This effectively
restores the old behavior.
Vulnerability Analysis
CVE-2024-50271 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2024-50271
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version d64696905554e919321e31afc210606653b8f6a4 and below 012f4d5d25e9ef92ee129bd5aa7aa60f692681e1 is affected.
- Version d64696905554e919321e31afc210606653b8f6a4 and below 4877d9b2a2ebad3ae240127aaa4cb8258b145cf7 is affected.
- Version d64696905554e919321e31afc210606653b8f6a4 and below 0208ea17a1e4456fbfe555f13ae5c28f3d671e40 is affected.
- Version d64696905554e919321e31afc210606653b8f6a4 and below 9e05e5c7ee8758141d2db7e8fea2cab34500c6ed is affected.
- Version 5.14 is affected.
- Before 5.14 is unaffected.
- Version 6.1.117, <= 6.1.* is unaffected.
- Version 6.6.61, <= 6.6.* is unaffected.
- Version 6.11.8, <= 6.11.* is unaffected.
- Version 6.12, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.