CVE-2024-49987

What it actually does

Calling qsort with a NULL pointer and zero size in bpftool when netfilter has no entries causes undefined behavior as reported by UBSan.

Why it matters to the business

Low operational risk of instability or crashes in bpftool during empty netfilter displays; limited downstream impact given low EPSS and lack of KEV status.

How an attack unfolds

An attacker triggers bpftool netfilter display with zero entries to invoke qsort(NULL, 0, ...), relying on the undefined behavior; no specific threat actor campaigns or ransomware use reported for this issue.

How to fix it

Upgrade affected packages to fixed versions including microcode_ctl 4:20210216-1.20210608.1.el8_4 or the Linux kernel commit c2d9f9a7837ab29ccae0c42252f17d436bf0a501; add early return when nf_link_info is NULL.

How to confirm the fix worked

Confirm early return prevents qsort(NULL, 0, ...) call and that UBSan no longer reports null pointer error in net.c when displaying empty netfilter data.

Typical attack path

1. Invoke bpftool to display netfilter information
2. Ensure no entries exist so nf_link_info is NULL
3. Trigger qsort call leading to undefined behavior

How to detect it

Search bpftool and kernel logs for UBSan runtime errors referencing null pointer passed to qsort or net.c line 827.

What your security team should do

• Apply the listed fixed versions promptly
• Rebuild or update bpftool binaries across Linux environments
• Enable UBSan or similar sanitizers in development and test pipelines for bpftool