CVE-2024-27431

What it actually does

The cpumap XDP path fails to zero-initialise the xdp_rxq_info structure passed to the XDP program, causing the xdp_md->rx_queue_index field to contain whatever random stack or heap bytes were previously present instead of a valid index.

Why it matters to the business

Linux systems running XDP programs attached to CPU maps may leak uninitialised kernel memory contents to user-space programs or experience unpredictable XDP behaviour, increasing the chance of information disclosure on any kernel that has not applied the fix.

How an attack unfolds

An attacker with the ability to load or attach an XDP program to a cpumap entry invokes the program; because the rxq structure is uninitialised, the program receives arbitrary kernel memory values in the rx_queue_index field, which can be read back through the XDP metadata return path.

How to fix it

Update the Linux kernel to the commit that zero-initialises the xdp_rxq_info structure (5f4e51abfbe6eb444fa91906a5cd083044278297) or apply the equivalent stable-branch patch; rebuild and reboot with the fixed kernel image.

How to confirm the fix worked

After patching, run an XDP program attached to a cpumap and verify that rx_queue_index consistently returns a valid zero-based index rather than random values; inspect the source or binary of the cpumap XDP handling code to confirm the zero-initialisation call is present.

Typical attack path

1. Obtain local access or the ability to load BPF/XDP programs on the target Linux system
2. Attach an XDP program to a cpumap entry
3. Trigger packet processing through that cpumap
4. Read the rx_queue_index value returned by the XDP program to observe uninitialised kernel memory

How to detect it

Review system logs for unexpected XDP program behaviour or non-zero rx_queue_index values on cpumap-attached programs; examine kernel builds for the presence of the zero-initialisation change in the cpumap source file.

What your security team should do

• Prioritise kernel updates on any system that uses XDP with cpumaps
• Audit custom XDP programs that rely on rx_queue_index for correctness after the update
• Monitor upstream stable kernel releases for the backported fix