CVE-2024-47703

What it actually does

A BPF LSM program returning a positive value from the file_alloc_security hook is misinterpreted by the filesystem as a valid file pointer instead of an error, triggering a kernel panic.

Why it matters to the business

Systems using BPF LSM programs can experience unexpected kernel crashes leading to denial of service and operational disruption; the issue affects Linux environments with custom LSM hooks and carries moderate urgency given listed threat actor interest in similar kernel flaws.

How an attack unfolds

An attacker crafts and loads a BPF program attached to the file_alloc_security LSM hook that deliberately returns a positive integer; when the kernel later performs file allocation the positive value is passed through IS_ERR checks and dereferenced as a pointer, causing the panic. Threat actors listed in campaigns targeting Linux kernel resource and bounds issues may adapt similar techniques.

How to fix it

Apply the upstream kernel patch that adds LSM return-value validation in the verifier; ensure deployed kernels contain the fix for CVE-2024-47703. For Puma (RubyGems) deployments listed as affected, upgrade to version 4.3.9 or later.

How to confirm the fix worked

Confirm the verifier now rejects BPF LSM programs returning positive values on file_alloc_security and other hooks; test by attempting to load a program returning a positive integer and verify rejection before attachment.

Typical attack path

1. Identify or gain ability to load unprivileged or privileged BPF programs on target
2. Attach malicious program to file_alloc_security LSM hook returning positive value
3. Trigger file allocation operations on the system
4. Cause kernel panic and denial of service

How to detect it

Review kernel logs for panic messages referencing file_alloc_security or LSM return values; inspect loaded BPF programs via bpftool or similar utilities for attachment to LSM hooks; correlate with threat actor activity involving Linux kernel resource mishandling.

What your security team should do

• Prioritize kernel updates containing the LSM return-value check
• Audit existing BPF LSM programs for unexpected positive return values
• Monitor for new kernel releases addressing similar verifier gaps
• Apply Puma 4.3.9 updates if that package is present in the environment