CVE-2024-36918

What it actually does

Missing bounds check during bloom filter map creation allows value sizes exceeding KMALLOC_MAX_SIZE, triggering integer overflow and subsequent kernel memory allocation failures or crashes.

Why it matters to the business

Unprivileged or containerized workloads on affected kernels can trigger system-wide crashes, causing denial of service and potential loss of availability for Linux hosts or Android devices; low immediate risk given minimal EPSS and absence from known exploitation campaigns.

How an attack unfolds

An attacker with the ability to load BPF programs (CAP_BPF or unprivileged BPF) submits a map creation request for a bloom filter with an oversized value that overflows the integer size field, bypassing earlier validation and reaching the allocator which then crashes the kernel.

How to fix it

Update the Linux kernel to the commit fa6995eeb62e74b5a1480c73fb7b420c270784d3 or later stable releases that include the bloom filter size validation; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm presence of the fix by checking kernel source for the bloom filter map creation path containing the KMALLOC_MAX_SIZE comparison, or verify running kernel version contains commit fa6995eeb62e74b5a1480c73fb7b420c270784d3.

Typical attack path

1. Obtain capability to create BPF maps on target system
2. Craft bloom filter map creation syscall with value size > KMALLOC_MAX_SIZE
3. Trigger integer overflow in size calculation
4. Cause kernel panic during memory allocation attempt

How to detect it

Review kernel logs for oops or panic entries mentioning bloom filter map creation or integer overflow during map allocation; correlate with audit logs showing BPF map creation syscalls from untrusted processes.

What your security team should do

• Prioritize kernel upgrades on any system exposing BPF to untrusted workloads
• Restrict unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 until patched
• Monitor for kernel oops/panic logs referencing bloom filter map allocation