CVE-2024-50164

What it actually does

The flaw allows BPF programs to bypass write checks to read-only maps (such as .rodata global maps) when the size register is non-constant, due to overloaded MEM_UNINIT semantics that skip initialization enforcement and treat memory as read-only for checks.

Why it matters to the business

Systems relying on eBPF for security or data isolation face risk of unauthorized memory modifications; low EPSS and absence from KEV reduce immediate urgency but prevalence of Linux kernels amplifies potential exposure across many environments.

How an attack unfolds

An attacker crafts a BPF program using a non-constant size register to invoke check_mem_size_reg with meta set to NULL, bypassing write verification while still passing boundary checks; this enables writes to read-only maps. Threat actors including those in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and groups targeting Linux Kernel Use of Uninitialized Resource Vulnerability have been associated with similar kernel flaws.

How to fix it

Upgrade the Linux kernel to a version containing the fix that separates MEM_UNINIT from MEM_WRITE semantics; apply the resolution from commit reverting MEM_UNINIT overloading and introducing explicit MEM_WRITE annotations. No firefox-specific fixes apply to this kernel issue despite listed entries.

How to confirm the fix worked

Confirm kernel source includes the fix for check_mem_size_reg and check_arg_pair_ok handling; recompile test BPF programs that previously bypassed RO map writes and verify they are now rejected; review verifier logs for proper ARG_PTR_TO_MEM and size pair enforcement.

Typical attack path

1. Compile and load a BPF program containing a helper call with variable-sized memory argument
2. Trigger check_mem_size_reg path where tnum_is_const fails on var_off
3. Force meta=NULL to disable raw mode initialization requirements
4. Perform write operation to a read-only map that should have been rejected
5. Escalate via modified kernel data structures

How to detect it

Review kernel audit logs and BPF verifier output for rejected or accepted programs involving variable memory sizes; search for unexpected writes to read-only maps via tracing tools; correlate with threat actor TTPs around Linux kernel out-of-bounds access vulnerabilities.

What your security team should do

• Apply kernel updates promptly on all affected distributions
• Disable unprivileged BPF loading via sysctl where feasible
• Monitor eBPF program loads for anomalous patterns
• Audit custom BPF programs for variable memory size usage