CVE-2024-50123

What it actually does

Out-of-bounds read in bpf_link_show_fdinfo() when handling sockmap link file descriptors due to a missing BPF_LINK_TYPE case.

Why it matters to the business

Kernel memory disclosure or crashes on systems using BPF sockmap links, with low observed exploitation risk and limited downstream impact.

How an attack unfolds

An attacker with local access creates or references a sockmap BPF link, then triggers fdinfo exposure through procfs or similar interfaces to read beyond allocated structures; no named threat actors have been tied to this specific issue despite broad Linux kernel campaigns.

How to fix it

Update the Linux kernel to commit 6d79f12c0ce2bc8ff5f109093df1734bd6450615 or later; apply the corresponding stable or distribution backports that include the missing BPF_LINK_TYPE sockmap case and added comments.

How to confirm the fix worked

Confirm kernel source contains the sockmap BPF_LINK_TYPE entry in bpf_link_show_fdinfo and that bpf_link_type comments are present; test by exercising sockmap link fdinfo paths without triggering OOB reads.

Typical attack path

1. Obtain local code execution or user access on a Linux system
2. Load or reference a sockmap BPF program creating a link fd
3. Invoke bpf_link_show_fdinfo() via /proc/<pid>/fdinfo or equivalent
4. Read kernel memory past the intended bounds

How to detect it

Review kernel logs and audit records for unexpected crashes or warnings around BPF link handling; inspect for repeated fdinfo accesses on sockmap fds in process traces.

What your security team should do

• Prioritize kernel updates on systems actively using BPF sockmap
• Monitor EPSS and KEV status for any increase in activity
• Restrict untrusted local access and BPF program loading where possible