CVE-2024-45020

What it actually does

Out-of-bounds memory read in the BPF verifier's stacksafe() function when comparing stack slot types across frames whose allocated_stack sizes differ, causing an invalid access and kernel crash.

Why it matters to the business

Unprivileged or container workloads using sched-ext or custom BPF programs can trigger kernel crashes, leading to system instability, service outages, and potential loss of availability on affected Linux hosts.

How an attack unfolds

An attacker supplies a crafted BPF program whose verification path reaches stacksafe() with cur->allocated_stack smaller than old->allocated_stack; the missing bounds check then dereferences memory beyond the current frame's allocation, crashing the verifier and the kernel.

How to fix it

Upgrade the Linux kernel to version 6.6.48 or later, or apply commit 7cad3174cc79519bf5f6c4441780264416822c08. Rebuild and reboot with the fixed kernel; container hosts should also update any vendored kernel or docker runtime that ships its own kernel.

How to confirm the fix worked

Confirm the running kernel reports version 6.6.48 or newer; attempt to load a test BPF program that previously triggered the crash and verify the verifier no longer panics.

Typical attack path

1. Obtain ability to load unprivileged or privileged BPF programs on the target host
2. Construct a BPF program that exercises the stacksafe comparison with mismatched allocated_stack sizes
3. Load the program via bpf() syscall or a framework such as sched-ext
4. Trigger the verifier path that calls stacksafe() and observe the resulting kernel oops or panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing 'stacksafe' or 'verifier crash' around the time of BPF program loads; correlate with audit records of bpf() syscalls from unexpected processes.

What your security team should do

• Prioritize kernel updates on any system exposing BPF to untrusted workloads within the next maintenance window
• Audit workloads that rely on sched-ext or custom BPF programs and restrict unprivileged BPF loading until patched
• Monitor vendor advisories for backported fixes in distribution kernels