CVE-2024-50203

What it actually does

The vulnerability allows a heap buffer overflow in emit_a64_mov_i64() during BPF trampoline code generation when tag-based KASAN is enabled, due to mismatched address sizes between size calculation and code emission passes for bpf_tramp_image addresses.

Why it matters to the business

On affected Linux systems, this could lead to kernel instability, crashes, or potential privilege escalation if exploited, affecting system reliability and security particularly on arm64 architectures with KASAN.

How an attack unfolds

An attacker with the ability to load BPF programs can trigger the mismatch in address emission for bpf_tramp_image, causing the code generator to write beyond the allocated heap buffer when using tagged addresses under tag-based KASAN.

How to fix it

Update the Linux kernel to the fixed commit 98f7e32f20d28ec452afb208f9cffc08448a2652 or later versions that correct the address emission logic in bpf, arm64.

How to confirm the fix worked

Verify the kernel source includes the fix commit, test BPF trampoline functionality with tag-based KASAN enabled, and confirm absence of overflow conditions during address emission.

Typical attack path

1. Identify vulnerable kernel version with BPF and KASAN support on arm64
2. Load a crafted BPF program that enables BPF_TRAMP_F_CALL_ORIG
3. Trigger size calculation pass followed by code generation pass with differing addresses
4. Exploit resulting heap buffer overflow to corrupt adjacent memory

How to detect it

Examine kernel logs for signs of memory corruption, BPF trampoline errors, or unexpected panics on arm64 systems; review audit logs for unusual BPF program loads.

What your security team should do

• Prioritize kernel updates on arm64 systems using BPF features
• Restrict unprivileged BPF program loading where feasible
• Monitor kernel logs for memory corruption indicators in BPF contexts