CVE-2024-50063

What it actually does

Allows bypass of BPF verifier assumptions on context parameter counts and return value rules when a program attached to one kernel hook tail-calls a program attached to a different hook, enabling invalid ctx accesses or disallowed return values to be accepted.

Why it matters to the business

Attackers could gain unauthorized kernel-level access or cause crashes on systems using BPF programs, increasing risk to Linux-based infrastructure with 786 downstream dependents; urgent patching required despite low EPSS as the issue affects core kernel security enforcement.

How an attack unfolds

An attacker loads two BPF programs attached to incompatible hooks, issues a tail call from the first to the second, and thereby bypasses verifier checks so that the second program's ctx accesses or return values violate the rules of the first hook; listed threat actors in 2024 zero-day and Linux kernel campaigns could leverage this for privilege escalation or evasion.

How to fix it

Upgrade the Linux kernel to a version containing the fix; for Rocky Linux 8 deployments also update the listed packages to the exact fixed versions provided (e.g., python-markupsafe 1.1.1-6.module+el8.4.0+570+c2eaf144, python-attrs 19.3.0-3.module+el8.4.0+570+c2eaf144, babel 2.7.0-11.module+el8.5.0+672+ab6eb015 and all other packages in the set).

How to confirm the fix worked

Confirm kernel version contains the tail-call restriction commit; verify package versions match the supplied fixed releases on Rocky Linux 8; re-run BPF verifier tests that previously allowed cross-hook tail calls.

Typical attack path

1. Identify kernel functions or LSM hooks with differing prototypes or return-value constraints
2. Compile and attach two separate BPF programs to those hooks
3. Insert a tail-call instruction from the first program into the second
4. Trigger the first hook so the tail call executes and verifier bypass occurs
5. Use resulting invalid ctx access or return value to violate kernel security policy

How to detect it

Review kernel audit logs and BPF event traces for unexpected tail-call activity between programs attached to different hooks; look for loading of BPF programs on mismatched hooks by the listed threat actors or in Linux kernel exploit campaigns.

What your security team should do

• Apply kernel and listed package updates immediately given 721 days since publication and presence in espionage/financial actor campaigns
• Audit all BPF programs for cross-hook tail calls and remove or refactor them
• Monitor EPSS trend and threat-actor reporting for any increase in exploitation attempts
• Restrict unprivileged BPF loading until patches are deployed