CVE-2024-43840

What it actually does

The flaw in arm64 BPF trampoline generation for BPF_TRAMP_F_CALL_ORIG uses emit_addr_mov_i64() which only handles 48-bit vmalloc addresses for the bpf_tramp_image pointer passed to __bpf_tramp_enter/exit; kzalloc-allocated images can exceed 48 bits, resulting in an invalid pointer and kernel crash.

Why it matters to the business

Linux systems using BPF programs with call-original trampolines face risk of kernel crashes and service disruption; with 286 downstream dependents the issue can propagate through dependent software stacks, increasing urgency for patching despite low exploitation scores.

How an attack unfolds

An attacker loads a BPF program setting BPF_TRAMP_F_CALL_ORIG on an arm64 system; the generated trampoline uses the limited address emitter for the kzalloc-backed bpf_tramp_image, passing a truncated pointer that crashes the kernel on trampoline entry or exit.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces emit_addr_mov_i64() with emit_a64_mov_i64(); apply available distribution updates promptly given the 286 downstream dependents and published date of 2024-08-17.

How to confirm the fix worked

Confirm the kernel source contains the change from emit_addr_mov_i64 to emit_a64_mov_i64 in the BPF trampoline generation code for arm64; test by loading a BPF program that exercises BPF_TRAMP_F_CALL_ORIG and verify no crash occurs.

Typical attack path

1. Identify or deploy a workload that triggers BPF trampoline generation with BPF_TRAMP_F_CALL_ORIG
2. Load the BPF program on an affected arm64 kernel
3. Trigger the trampoline path that invokes __bpf_tramp_enter/exit
4. Kernel crashes due to invalid pointer dereference

How to detect it

Review kernel logs for oops or panic messages referencing bpf_tramp_enter, bpf_tramp_exit or trampoline address handling; inspect BPF program load events and arm64-specific trampoline generation in ftrace or perf data for signs of the faulty address move.

What your security team should do

• Prioritize kernel updates on arm64 systems that use BPF
• Audit workloads for use of BPF_TRAMP_F_CALL_ORIG trampolines
• Monitor EPSS trend and any emerging threat actor activity
• Apply the fix across all affected kernel versions before the CISA-style deadlines if KEV status changes