CVE-2024-47675

What it actually does

A use-after-free occurs in bpf_uprobe_multi_link_attach when bpf_link_prime fails, leading to freeing bpf_uprobe structures without unregistering, leaking uprobe references and freeing consumers still on the list.

Why it matters to the business

Attackers could potentially crash the kernel or execute arbitrary code on affected Linux systems, leading to system instability or compromise, though exploitation is not widespread.

How an attack unfolds

An attacker would need to trigger the error path in bpf_uprobe_multi_link_attach by causing bpf_link_prime to fail, then manipulate the freed memory structures to achieve use-after-free exploitation.

How to fix it

Upgrade to a kernel version containing commit 790c630ab0e7d7aba6d186581d4627c09fce60f3 or later.

How to confirm the fix worked

Check kernel version and verify the commit is present in the source.

Typical attack path

1. Identify vulnerable kernel version
2. Load a BPF program that attaches multiple uprobes
3. Force bpf_link_prime to fail
4. Exploit the freed consumer list

How to detect it

Look for kernel panics or oops related to BPF uprobes in system logs.

What your security team should do

• Apply the kernel patch immediately
• Monitor for any BPF-related crashes
• Update all affected systems