CVE-2024-49850

What it actually does

Malformed BPF_CORE_TYPE_ID_LOCAL relocation record referencing a non-existing BTF type triggers null pointer dereference inside bpf_core_calc_relo_insn when processing the record from user space.

Why it matters to the business

Kernel panic or denial-of-service on systems processing untrusted BPF programs; low exploitability and no known active campaigns reduce immediate operational risk, though kernel stability remains a concern for high-uptime environments.

How an attack unfolds

An attacker crafts a minimal BPF program accompanied by a single relocation record that specifies a nonexistent type ID and submits it through the bpf syscall; the kernel’s relocation handler dereferences a null pointer and crashes.

How to fix it

Upgrade cocoapods-downloader to version 1.6.0 or later; apply the upstream kernel patch that adds an existence check for the referenced BTF type before calling bpf_core_calc_relo_insn.

How to confirm the fix worked

Confirm the kernel contains the check for a valid BTF type before processing BPF_CORE_TYPE_ID_LOCAL relocations; verify cocoapods-downloader reports version 1.6.0 or higher.

Typical attack path

1. Craft BPF program with .insn_off = 0 and .type_id referencing a nonexistent BTF type
2. Set .kind = BPF_CORE_TYPE_ID_LOCAL and supply a valid access_str_off
3. Load the program via bpf() syscall or equivalent loader
4. Trigger relocation processing which reaches bpf_core_calc_relo_insn without type validation

How to detect it

Review kernel logs for oops or null pointer dereference messages occurring during bpf syscall processing; inspect audit logs for BPF program loads containing relocation records with high or invalid type IDs.

What your security team should do

• Apply the kernel patch or distribution update containing the BTF type validation fix
• Upgrade cocoapods-downloader to 1.6.0 across all build and CI systems
• Monitor for unexpected kernel oops or crashes during BPF program loads
• Restrict unprivileged BPF loading until patches are deployed