CVE-2024-50161

What it actually does

The flaw is an unchecked array index in btf_repeat_fields() inside btf_parse_fields() when the product of ret and nelems exceeds BTF_FIELDS_MAX, resulting in an out-of-bounds write into the btf_field_info array.

Why it matters to the business

Kernel instability or memory corruption on systems that create BPF maps containing arrays of nested structs; high-urgency environments must patch before the CISA deadline to avoid denial-of-service or escalation risks.

How an attack unfolds

An attacker supplies a malicious BTF layout via a BPF map creation syscall; the kernel enters btf_parse_fields() and btf_repeat_fields() without validating remaining info_cnt, triggering the out-of-bounds access during field repetition.

How to fix it

Apply the upstream fix that adds an explicit remaining-info_cnt check inside btf_repeat_fields(); upgrade to a kernel containing commit that resolves CVE-2024-50161.

How to confirm the fix worked

Confirm the patched btf.c no longer contains the vulnerable repetition logic; test map creation with oversized nested arrays and verify absence of UBSAN reports or kernel oops.

Typical attack path

1. Craft BTF type information describing an array of nested structs sized to exceed BTF_FIELDS_MAX when repeated
2. Invoke map_create() or equivalent BPF syscall with the crafted BTF
3. Trigger btf_parse_fields() → btf_repeat_fields() path that performs the unchecked index calculation
4. Cause UBSAN-detected out-of-bounds access or subsequent memory corruption

How to detect it

Search kernel logs for UBSAN array-index-out-of-bounds messages referencing btf.c:3951 and btf_parse_fields; monitor for unexpected map_create failures or oops involving PID of bpftool/test_progs processes.

What your security team should do

• Prioritize kernel updates on all systems exposing BPF to untrusted workloads
• Audit custom BPF programs and loaders that construct complex nested BTF types
• Enable kernel UBSAN or similar sanitizers in test environments to surface similar bounds issues early