CVE-2024-36481

What it actually does

The vulnerability stems from parse_btf_field() only checking for a NULL return from btf_find_struct_member() instead of also using IS_ERR() to detect error pointers, allowing invalid pointer handling during BTF field parsing in kernel tracing probes and resulting in potential crashes or instability.

Why it matters to the business

Local users may trigger kernel instability or denial of service in tracing functionality, disrupting observability and operations on affected Linux systems; low immediate risk given no known exploits, stable low EPSS, and the age of the issue, but kernel updates remain essential for environments relying on dynamic probes.

How an attack unfolds

An attacker with local access supplies crafted input to the tracing/probes subsystem that causes btf_find_struct_member() to return an error pointer via ERR_PTR(); the missing IS_ERR() check in parse_btf_field() allows the error to propagate, leading to invalid memory operations or crashes during BTF processing.

How to fix it

Upgrade the Linux kernel to a version containing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa, which adds the proper IS_ERR() check and error propagation in parse_btf_field().

How to confirm the fix worked

Inspect the kernel source for the updated parse_btf_field() implementation containing both NULL and IS_ERR() checks, or confirm the presence of the referenced commit in the running kernel tree.

Typical attack path

1. Gain local user access on a vulnerable Linux system
2. Interact with the tracing or ftrace interface to load probes involving BTF data
3. Trigger parse_btf_field() with input that causes btf_find_struct_member() to return an error pointer
4. Exploit the absent error check to induce kernel instability or crash

How to detect it

Review kernel logs and dmesg output for crashes or warnings originating from tracing/probes or BTF-related functions; monitor for unexpected probe loading failures or oops messages after BTF operations.

What your security team should do

• Apply the kernel fix via the specified commit or a subsequent release containing it
• Prioritize updates on systems that actively use dynamic tracing or probes
• Review and restrict local tracing privileges where feasible until patched