CVE-2024-42068

What it actually does

set_memory_ro() failure in bpf_prog_lock_ro() is not checked, leaving BPF program memory writable instead of read-only.

Why it matters to the business

Linux systems using BPF may experience reduced memory protection, increasing risk of local memory corruption or crashes on affected kernels.

How an attack unfolds

A local user triggers BPF program loading where set_memory_ro() fails silently, leaving pages writable and enabling subsequent unauthorized memory writes.

How to fix it

Update the Linux kernel to commit a359696856ca9409fb97655c5a8ef0f549cb6e03 or later stable release containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit a359696856ca9409fb97655c5a8ef0f549cb6e03 and test that bpf_prog_lock_ro() now propagates set_memory_ro() errors.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Load or attach a BPF program that invokes bpf_prog_lock_ro()
3. Force or observe set_memory_ro() failure path
4. Write to the now-unprotected memory region

How to detect it

Review kernel logs for BPF-related memory protection failures around program load times; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all production Linux systems within standard patch windows
• Monitor upstream stable kernel releases for backports of the fix
• Review BPF usage in security-sensitive environments for additional hardening