CVE-2024-35917

What it actually does

Incorrect pointer subtraction between distinct objects in s390 BPF JIT plt construction violates C aliasing rules, allowing GCC to reorder memcpy after address assignments and write NULLs into bpf_plt structures instead of return/target addresses, causing subsequent dereference crashes.

Why it matters to the business

s390 Linux systems using BPF may suffer sudden kernel crashes and reboots when certain BPF programs or tests execute, resulting in unplanned downtime for workloads relying on eBPF.

How an attack unfolds

An attacker with local access crafts or loads a BPF program exercising the bpf_struct_ops path; the compiler reordering triggered by the non-compliant pointer arithmetic writes invalid addresses, leading to a NULL dereference and kernel oops when the program runs.

How to fix it

Update the Linux kernel to a version containing commit c3062bdb859b6e2567e7f5c8cde20c0250bb130f which replaces the pointer arithmetic with hardcoded offsets.

How to confirm the fix worked

Verify the running kernel contains commit c3062bdb859b6e2567e7f5c8cde20c0250bb130f or later; re-run the dummy_st_ops/dummy_init_ptr_arg test and confirm no crash occurs.

Typical attack path

1. Obtain local unprivileged access on s390 Linux
2. Load a BPF program or trigger the dummy_st_ops test path via bpf syscall
3. Trigger execution of bpf_struct_ops_test_run which invokes the faulty JIT plt code
4. Kernel dereferences the corrupted plt entry causing oops and potential panic

How to detect it

Search kernel logs and dmesg for stack traces containing bpf_struct_ops_test_run, bpf_jit_plt, or the exact NULL dereference address pattern shown in the crash report.

• bpf_struct_ops_test_run+0x156/0x250
• 0x2
• __sys_bpf+0xa1a/0xd00

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on all s390 systems
• Audit BPF usage in production workloads for exposure to the affected code path
• Monitor for kernel oops involving bpf_struct_ops_test_run in system logs