CVE-2024-43873

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50

Description The issue is related to the incorrect initialization of the seqpacket allow function in the Linux kernel. There are two problems with seqpacket allow: it is not initialized when a socket is created, and if VIRTIO VSOCK F SEQPACKET is set and then cleared, seqpacket allow will not be cleared properly. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations To fix the issue, initialize seqpacket allow after allocation and set it unconditionally in set features. Update to Linux kernel version 6.6.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable vhost/vsock module to minimize the risk of exploitation.