CVE-2024-26589

What it actually does

The flaw permits variable-offset ALU operations on PTR_TO_FLOW_KEYS pointers in BPF programs. Validation in check_flow_keys_access() only inspects fixed offsets, so the variable offset is never range-checked, allowing subsequent loads or stores to reach out-of-bounds kernel memory.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or memory corruption, leading to denial of service or potential privilege escalation on servers, containers, and endpoints that run eBPF workloads.

How an attack unfolds

An attacker compiles and loads a BPF program that obtains a flow_keys pointer from the context, performs a sequence of ALU operations to create a variable offset (for example by dividing and masking a scalar), adds that offset to the pointer, and then dereferences the resulting address. Because the verifier accepts the program, the kernel executes the out-of-bounds access when the program runs.

How to fix it

Upgrade the Linux kernel to a version containing commit 29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0 or later; rebuild and reboot with the patched kernel. Where immediate patching is impossible, restrict unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 and limit CAP_BPF or CAP_PERFMON privileges.

How to confirm the fix worked

Confirm the running kernel contains commit 29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0; attempt to load a test BPF program containing variable-offset arithmetic on a flow_keys pointer and verify the verifier now rejects it with the message "R7 pointer arithmetic on flow_keys prohibited".

Typical attack path

1. Obtain local execution on a system running an affected kernel
2. Craft a BPF program that loads a flow_keys pointer and applies variable-offset arithmetic
3. Load the program via bpf() syscall (e.g., during test-run or attach to a flow-dissector hook)
4. Trigger execution of the program to perform the unchecked memory access
5. Observe kernel page fault or exploit the corruption for further impact

How to detect it

Search kernel logs for page-fault messages containing "unable to handle page fault" near bpf_flow_dissect or bpf_dispatcher_nop_func; look for audit records of bpf() syscalls that load programs with flow-dissection or test-run operations; inspect verifier rejection logs for the string "pointer arithmetic on flow_keys prohibited" after patching.

• BUG: unable to handle page fault for address: ffffc900
• bpf_flow_dissect+0x15f/0x350
• R7 pointer arithmetic on flow_keys prohibited

What your security team should do

• Apply the kernel patch containing commit 29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0 as soon as possible
• Disable unprivileged BPF loading on all production systems
• Audit which services or containers require CAP_BPF or CAP_PERFMON and reduce the set where feasible
• Monitor for kernel oops or page-fault reports referencing bpf_flow_dissect or flow_dissector