CVE-2024-50165

What it actually does

Memory leak in bpf_parse_param() where param->string is overwritten without preserving the original kmalloc allocation, preventing later free and leaving unreferenced objects.

Why it matters to the business

Gradual memory exhaustion on affected systems can lead to performance degradation, instability, or denial of service over time, especially in high-volume BPF or filesystem configuration workloads.

How an attack unfolds

An attacker invokes the fsconfig syscall with crafted mount options that exercise bpf_parse_param(), causing the kernel to leak small allocations each time the path is hit; repeated triggering depletes memory without crashing immediately.

How to fix it

Apply the kernel fix that preserves param->string for later freeing; for the listed firefox packages on Ubuntu 14.04 LTS upgrade to 43.0+build1-0ubuntu0.14.04.1 or newer.

How to confirm the fix worked

Confirm the updated kernel or firefox package is installed, reproduce the fsconfig path under memory-leak detection tools such as kmemleak, and verify no unreferenced objects remain after the call sequence.

Typical attack path

1. Invoke __x64_sys_fsconfig or related mount configuration syscalls
2. Supply parameters that reach strndup_user and bpf_parse_param
3. Trigger the code path that discards the original param->string pointer
4. Repeat to accumulate unreferenced kmalloc objects

How to detect it

Inspect kernel memory leak reports from kmemleak or similar tools for objects allocated via memdup_user or strndup_user originating from fsconfig; correlate with process activity invoking mount or BPF parameter parsing.

What your security team should do

• Prioritize patching systems running untrusted BPF programs or frequent filesystem configuration
• Monitor for memory pressure indicators on long-lived hosts
• Review any downstream package dependencies for the affected kernel code