CVE-2024-42151

What it actually does

The verifier incorrectly assumes a BPF program parameter cannot be NULL, potentially removing a required NULL check and causing a NULL pointer dereference when the test_1 function receives a NULL state pointer.

Why it matters to the business

Systems running affected Linux kernels may experience kernel panics or crashes when executing specific BPF programs that pass NULL to certain struct_ops functions, leading to service disruptions.

How an attack unfolds

An attacker loads a malicious BPF program using dummy_st_ops that passes NULL to test_1, and due to verifier optimization, the NULL check is bypassed, resulting in dereference.

How to fix it

Update the Linux kernel to the fixed commit 7f79097b0de97a486b137b750d7dd7b20b519d23 or apply equivalent patches that mark the bpf_dummy_struct_ops.test_1 parameter as nullable.

How to confirm the fix worked

Verify the kernel source includes the commit marking bpf_dummy_struct_ops.test_1 parameter as nullable and confirm the dummy_st_ops/dummy_init_ret_value test case passes without verifier removing the NULL check.

Typical attack path

1. Craft a BPF program with SEC("struct_ops/test_1") that checks for NULL state
2. Load the program into the kernel via bpf() syscall
3. Trigger execution path where state pointer is NULL
4. Observe kernel NULL pointer dereference

How to detect it

Inspect kernel oops and panic logs for references to bpf_dummy_struct_ops or test_1 function execution under NULL conditions; review audit logs for unusual BPF program loads.

What your security team should do

• Apply the kernel patch or upgrade to a fixed version immediately on exposed systems
• Audit custom BPF programs using struct_ops for proper NULL handling
• Monitor kernel logs for oops/panics involving bpf_dummy_struct_ops