CVE-2024-49888

What it actually does

BPF signed division and modulo instructions fail to handle edge cases (LLONG_MIN/-1, INT_MIN/-1, and equivalent modulo operations) causing an unhandled divide-by-zero or overflow exception on x86_64 that results in a kernel oops and crash.

Why it matters to the business

Unprivileged or containerized workloads that load BPF programs can trigger kernel panics, leading to denial of service, workload restarts, and potential loss of availability on affected Linux systems; the large number of container-related packages listed indicates broad downstream exposure in container runtimes and orchestration layers.

How an attack unfolds

An attacker crafts a BPF program containing an sdiv or smod instruction whose divisor evaluates to -1 and whose dividend is INT_MIN or LLONG_MIN. When the program is loaded and executed on x86_64, the processor raises a divide error that the kernel does not catch, resulting in an immediate crash. The supplied patch rewrites the problematic operations to produce the same results observed on arm64 (LLONG_MIN or 0) without generating an exception.

How to fix it

Upgrade the Linux kernel to a version containing commit 4902a6a0dc593c82055fc8c9ada371bafe26c9cc or later. For Rocky Linux 8 container tooling apply the listed fixed package versions: oci-systemd-hook-0.1.15-2.git2d0b8a3, oci-umount-2.3.4-2.git87f9237, fuse-overlayfs-0.3-5, containernetworking-plugins-0.7.4-4.git9ebe139, runc-1.0.0-56.rc5.dev.git2abd837, skopeo-0.1.32-6.git1715c90.

How to confirm the fix worked

Confirm the running kernel contains the cited commit or is newer than the published date; recompile and load a test BPF program that performs the previously crashing sdiv/smod operations and verify the kernel remains stable.

Typical attack path

1. Identify a context where untrusted BPF programs can be loaded (e.g., user namespaces, containers, or tracing).
2. Load a BPF program containing an sdiv/smod instruction with the dangerous constant or register values.
3. Trigger execution of the BPF program to induce the divide error.
4. Kernel panics and the system becomes unavailable or reboots.

How to detect it

Search kernel logs for oops messages containing 'divide error' together with BPF-related frames or KASAN output; correlate with process names or audit events showing BPF program loads immediately preceding the crash.

• Oops: divide error: 0000
• bpf: Fix a sdiv overflow issue

What your security team should do

• Prioritize kernel updates on any system that permits unprivileged BPF loading.
• Restrict BPF program loading to privileged users or enable BPF LSM policies until patches are applied.
• Monitor for the listed fixed package versions in container host images and rebuild pipelines.