CVE-2024-27050

What it actually does

Unconditional assignment to feature_flags and xdp_zc_max_segs fields in bpf_xdp_query_opts without OPTS_SET() causes out-of-bounds writes beyond the struct size when callers were compiled against older libbpf versions, resulting in stack corruption.

Why it matters to the business

Programs using libbpf for XDP queries on systems with mixed library versions can crash or behave unpredictably, disrupting network packet processing and requiring emergency updates across Linux environments.

How an attack unfolds

An attacker with local access compiles an application against an older libbpf version lacking the new fields, then triggers bpf_xdp_query operations; the vulnerable libbpf writes past the end of the smaller opts struct on the stack, corrupting adjacent memory.

How to fix it

Update to libbpf containing commit fa5bef5e80c6a3321b2b1a7070436f3bc5daf07c so that both new fields are written exclusively via the OPTS_SET() macro; rebuild and redeploy affected applications against the corrected library.

How to confirm the fix worked

Inspect the bpf_xdp_query() implementation for OPTS_SET() usage on feature_flags and xdp_zc_max_segs, or confirm the running libbpf shared object matches a build after the referenced commit.

Typical attack path

1. Locate applications or tools invoking bpf_xdp_query on the target system
2. Supply or compile code built against a pre-fix libbpf that declares a smaller opts struct
3. Execute XDP query operations that reach the unconditional field assignments
4. Trigger stack corruption leading to crashes or denial of service

How to detect it

Search kernel and application logs for segmentation faults or aborts in processes calling bpf_xdp_query shortly after XDP feature queries; correlate with process core dumps showing stack overwrites near opts structures.

What your security team should do

• Apply the fixed libbpf commit or distribution package update within the next maintenance window
• Scan source trees and containers for direct use of bpf_xdp_query_opts
• Re-test XDP-enabled workloads after the upgrade to verify stability