CVE-2024-47702

What it actually does

Sign-extension of 32-bit loads for packet data/data_end/data_meta uapi fields in BPF __sk_buff context causes invalid kernel addresses after convert_ctx_accesses, allowing unverified pointer arithmetic that can crash the kernel.

Why it matters to the business

Linux systems using eBPF for networking or observability face risk of kernel panics and service outages; low EPSS indicates limited current exploitation but high severity in affected kernels, with no ransomware linkage.

How an attack unfolds

An attacker loads a signed 32-bit value from skb->data into a BPF register, triggers sign-extension during verification, then performs pointer arithmetic that produces an invalid packet address at runtime, bypassing intended safety checks.

How to fix it

Upgrade affected Linux kernels to a version containing the fix that rejects sign-extended accesses to packet data fields in is_valid_access(); loofah (RubyGems) users should update to 2.19.1 where applicable in their environment.

How to confirm the fix worked

Confirm kernel source contains the added sign-extension rejection in the is_valid_access callback for packet pointers; test with sample BPF programs that previously triggered sign-extension loads.

Typical attack path

1. Compile BPF program performing signed 32-bit load of __sk_buff data/data_end/data_meta
2. Submit program to kernel verifier via bpf syscall
3. Bypass is_valid_access checks for sign-extension
4. Execute converted program that dereferences invalid address
5. Trigger kernel crash or memory corruption

How to detect it

Review kernel logs for BPF verifier errors mentioning sign-extension or ctx member accesses; inspect audit logs for unusual bpf syscall activity from untrusted users; check for crashes in functions handling __sk_buff loads.

• bpf: sign-extension of packet data
• r2 = *(s32 *)(r1 + 76)
• convert_ctx_accesses sign extend
• is_valid_access packet pointer sign-extension

What your security team should do

• Prioritize kernel updates on systems running untrusted or complex BPF programs
• Monitor for BPF verification failures or crashes referencing ctx member accesses
• Restrict unprivileged BPF loading until patches are applied