CVE-2024-42067

What it actually does

set_memory_rox() failure in bpf_jit_binary_lock_ro() is not checked, leaving JITed BPF memory writable instead of read-only-execute and exposing the kernel to integrity or stability issues from subsequent memory operations.

Why it matters to the business

Linux systems running affected kernels may experience unexpected crashes or degraded stability when BPF programs are loaded, increasing operational risk for workloads that rely on eBPF; urgency remains low given absent exploitation and low EPSS.

How an attack unfolds

An attacker with local access crafts conditions that cause set_memory_rox() to fail inside bpf_jit_binary_lock_ro(); the missing error check allows the BPF JIT region to remain unprotected, after which the attacker may attempt to leverage the writable memory for further kernel manipulation or denial-of-service.

How to fix it

Update the Linux kernel to a version containing commit 044da7ae7afd4ef60806d73654a2e6a79aa4ed7a or later; rebuild and reboot with the patched kernel; verify the fix is present by inspecting the bpf_jit_binary_lock_ro() implementation.

How to confirm the fix worked

Confirm the running kernel contains commit 044da7ae7afd4ef60806d73654a2e6a79aa4ed7a; attempt to load BPF programs under memory-constrained conditions and verify that failures in set_memory_rox() now cause the operation to bail out cleanly without leaving memory unprotected.

Typical attack path

1. Obtain local user privileges on a vulnerable Linux system
2. Load or trigger a BPF program that invokes bpf_jit_binary_lock_ro()
3. Force set_memory_rox() to return an error (e.g., via memory pressure or allocator interference)
4. Exploit the resulting unprotected memory region to cause kernel instability or attempt privilege escalation

How to detect it

Review kernel logs for bpf_jit_binary_lock_ro() error paths or unexpected set_memory_rox() failures; correlate with BPF program load events in audit or trace logs; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching production kernels that host eBPF workloads within standard change windows
• Monitor upstream stable branches for backports of the referenced commit
• Review any custom BPF programs or loaders for assumptions about JIT memory protection
• Add kernel version checks to vulnerability scanners and asset inventories