CVE-2024-43843

What it actually does

Inconsistent sizing of the 'im' argument between dry-run and real patch phases in RISC-V BPF trampoline preparation causes emit_imm to emit a variable number of instructions, resulting in out-of-bounds memory access when populating the allocated image.

Why it matters to the business

Potential kernel instability, crashes, or memory corruption on RISC-V systems; 43 downstream dependents increase the blast radius across dependent packages and deployments.

How an attack unfolds

An attacker loads a specially crafted BPF program that exercises the trampoline patching path; the mismatch between dry-run size calculation and actual instruction emission during the real patch phase triggers the out-of-bounds condition in RV64 address generation.

How to fix it

Upgrade opencv-python-headless to version 4.8.1.78 or later; apply the upstream kernel commit that emits the maximum number of instructions for the 'im' address during the dry-run phase.

How to confirm the fix worked

Confirm the installed kernel contains the fix for commit 26ef208c209a and that opencv-python-headless reports version 4.8.1.78; run BPF trampoline test cases to verify consistent image sizing.

Typical attack path

1. Locate a vulnerable RISC-V Linux kernel with BPF enabled
2. Prepare and load a BPF program that forces trampoline image allocation
3. Trigger the dry-run versus patch phase inconsistency
4. Cause out-of-bounds write via emit_imm

How to detect it

Review kernel logs for BPF trampoline allocation failures or unexpected instruction counts; inspect audit logs for unusual BPF program loads on RISC-V hosts.

What your security team should do

• Prioritize patching systems with RISC-V and BPF workloads given the 43 downstream dependents
• Monitor EPSS and exploit maturity for any upward trend
• Add kernel log review for trampoline-related errors to existing detection playbooks