CVE-2024-42161

What it actually does

Uninitialized 'val' variable in BPF_CORE_READ_BITFIELD macro when __builtin_preserve_field_info returns unexpected BYTE_SIZE, allowing use of garbage data instead of a guaranteed zero default.

Why it matters to the business

Potential kernel memory corruption, privilege escalation, or crashes on Linux systems running affected kernels with eBPF workloads; widespread exposure due to kernel ubiquity.

How an attack unfolds

An attacker with local access loads a crafted BPF program that triggers the macro with an unexpected field byte size; the uninitialized val leads to out-of-bounds reads or writes during core relocation processing. Threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel uninitialized resource issues.

How to fix it

Upgrade the Linux kernel to the fixed commit b694989bb13ed5f166e633faa1eb0f21c6d261a6 or later stable release containing the default case that initializes val to zero.

How to confirm the fix worked

Confirm the patch is present by checking bpf_core_read.h for the default: case that sets val = 0; rebuild and run BPF selftests to verify no GCC uninitialized warning and no regressions in core read operations.

Typical attack path

1. Identify Linux kernel versions prior to the fixed commit
2. Obtain local execution or container access
3. Compile and load a malicious BPF program exercising the CORE_READ_BITFIELD macro
4. Trigger the switch path with unexpected BYTE_SIZE to consume uninitialized val
5. Achieve memory corruption or information leak for privilege escalation

How to detect it

Review kernel logs for unexpected values or crashes in BPF core read paths; inspect audit logs for unusual BPF program loads around the time of suspected activity; correlate with threat actor campaigns targeting Linux kernel resource initialization flaws.

What your security team should do

• Prioritize kernel upgrades on all production systems using eBPF
• Monitor for new stable releases and apply within patch windows
• Restrict unprivileged BPF loading via sysctl until updated
• Audit custom BPF programs for reliance on CORE_READ_BITFIELD macros