CVE-2024-35905

What it actually does

Integer overflow in BPF verifier stack access size calculation allows negative values to reach check_stack_range_initialized(), causing out-of-bounds array accesses during program verification.

Why it matters to the business

Local users on unpatched Linux systems can submit crafted BPF programs that trigger verifier flaws, potentially leading to kernel memory corruption, privilege escalation, or denial of service affecting system stability and multi-tenant environments.

How an attack unfolds

An attacker compiles a BPF program containing an access size crafted to overflow a signed int, bypassing earlier size checks; the missing protection in check_stack_range_initialized() then permits out-of-bounds verifier accesses that can be leveraged for further kernel exploitation, as referenced in Android kernel RCE contexts.

How to fix it

Upgrade Linux kernel to version 5.10.215 or later, or apply commit 9970e059af471478455f9534e8c3db82f8c5496d from the stable git repository; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; confirm BPF verifier rejects programs with negative stack access sizes via bpftool or kernel logs; re-test with known overflow-triggering test cases.

Typical attack path

1. Compile and load a malicious BPF program with overflowing stack access size
2. Trigger BPF verifier path that reaches check_stack_range_initialized() without prior negative-size guard
3. Exploit resulting out-of-bounds array access to corrupt kernel memory or bypass security checks
4. Escalate privileges or achieve code execution within the kernel context

How to detect it

Review kernel audit logs and BPF verifier error messages for unexpected negative-size rejections or crashes in check_stack_range_initialized(); correlate with process creation of bpftool or custom loaders submitting unusual programs.

What your security team should do

• Prioritize patching production kernels within 30 days given local attack surface
• Restrict unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1 where feasible
• Monitor for new exploit PoCs targeting this verifier path and update detection rules accordingly