CVE-2024-40908

What it actually does

Missing run context initialization for raw tracepoint programs executed via the BPF test_run interface allows helpers that dereference task->bpf_ctx to access an uninitialized pointer, resulting in a kernel crash.

Why it matters to the business

Local users or automated test frameworks can trigger kernel panics on affected Linux systems, causing denial of service and potential loss of availability for workloads relying on the kernel.

How an attack unfolds

An attacker loads a raw tracepoint BPF program that invokes helpers such as bpf_get_attach_cookie through the test_run interface; because the run context pointer is not set, the helper dereferences an invalid task->bpf_ctx value and crashes the kernel. Threat actors have been observed targeting similar Linux kernel resource-handling flaws in espionage and financially motivated campaigns.

How to fix it

Update the Linux kernel to a version containing commit 789bd77c9342aa6125003871ae5c6034d0f6f9d2 or later; rebuild and reboot with the patched kernel. Where live patching is available, apply the vendor's live patch for this fix.

How to confirm the fix worked

Confirm the running kernel contains commit 789bd77c9342aa6125003871ae5c6034d0f6f9d2 or a backport; attempt to load and run a rawtp program calling bpf_get_attach_cookie via test_run and verify the kernel no longer panics.

Typical attack path

1. Obtain local access or ability to load BPF programs
2. Prepare a rawtp program that calls bpf_get_attach_cookie or similar helpers
3. Invoke the program via the BPF test_run interface
4. Trigger dereference of unset task->bpf_ctx leading to crash

How to detect it

Review kernel logs for oops/panic entries mentioning bpf_get_attach_cookie or rawtp test_run; inspect audit logs for unusual BPF program loads via test_run; check for processes exercising the BPF syscall with BPF_PROG_TEST_RUN on raw tracepoint programs.

What your security team should do

• Prioritize kernel updates on systems that allow unprivileged BPF test_run usage
• Restrict BPF program loading to trusted users via system policies
• Monitor for kernel oops or panic logs related to BPF helpers
• Apply the fix before the next scheduled maintenance window given the public availability of the patch