CVE-2024-38662

What it actually does

The vulnerability permitted BPF programs attached to tracepoints to perform map_delete operations on sockmap/sockhash maps, bypassing the verifier's allowed-program-type checks that previously only covered updates, leading to locking rule violations.

Why it matters to the business

Organizations running affected Linux kernels may experience system instability, crashes, or unexpected behavior in environments using BPF sock maps for networking or security functions, with low but non-zero risk of exploitation given the local attack vector and high complexity.

How an attack unfolds

An attacker with local access crafts a BPF program attached to a tracepoint that performs a delete operation on a sockmap or sockhash; the verifier previously allowed this for programs that could update the map, triggering a locking violation report from syzkaller-style testing. No known active exploitation by threat actors despite the listed Android kernel reference.

How to fix it

Update to Linux kernel versions containing the fix that extends the verifier check to cover deletes from sockmap/sockhash. For gradio-app/gradio (GIT) environments listed as affected, upgrade to commit 49d9c48537aa706bf72628e3640389470138bdc6.

How to confirm the fix worked

Confirm the kernel patch is applied by checking verifier logic for sockmap/sockhash delete operations; test by attempting disallowed delete operations from tracepoint programs and verifying rejection.

Typical attack path

1. Obtain local user access on a Linux system
2. Load a tracepoint-attached BPF program that targets sockmap/sockhash deletion
3. Trigger the program to invoke map_delete without update authorization
4. Cause verifier-enforced locking rule violation

How to detect it

Review kernel logs for BPF verifier warnings or locking violation reports related to sockmap/sockhash deletes from tracepoints; examine loaded BPF programs for unauthorized map operations.

What your security team should do

• Prioritize kernel updates on systems using BPF sock maps
• Monitor for local privilege or stability issues in BPF networking code
• Review BPF program types allowed to modify sockmap/sockhash
• Apply the listed gradio commit if using that package in affected environments