CVE-2024-50253

What it actually does

Missing validation of nr_words in bpf_iter_bits_new() permits multiplication overflow on nr_bits (e.g., nr_words=0x04000001 yields nr_bits=64), causing bpf_probe_read_kernel_common to receive an oversized nr_bytes (0x20000008) that corrupts the stack.

Why it matters to the business

Kernel memory corruption on Linux systems can produce crashes, privilege escalation, or arbitrary code execution; low EPSS and absence from KEV reduce urgency, yet the issue affects the core BPF allocator used across the ecosystem.

How an attack unfolds

An attacker supplies a crafted BPF iterator program containing an out-of-range nr_words value; the missing check allows overflow, oversized kernel read, and stack overwrite, which may be chained by espionage or financially motivated actors noted in related Linux kernel campaigns.

How to fix it

Apply the upstream fix that caps nr_words at 511 and calls bpf_mem_alloc_check_size() before the read; return -E2BIG for oversized requests. Rebuild and reboot to the corrected kernel; the listed flashplugin-nonfree package is fixed at 11.2.202.535ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the presence of the nr_words bounds check and bpf_mem_alloc_check_size() call in the running kernel source or binary; fuzz bpf_iter_bits_new with nr_words=512 and verify -E2BIG is returned without stack corruption.

Typical attack path

1. Locate a system running an unpatched kernel with BPF enabled
2. Load a malicious BPF program via bpf_iter_bits_new with nr_words > 511
3. Trigger multiplication overflow and excessive nr_bytes read
4. Corrupt kernel stack to gain code execution or cause denial of service

How to detect it

Review kernel logs for bpf_iter_bits_new failures or oversized allocation warnings; inspect auditd or eBPF telemetry for programs requesting abnormally large nr_words values; correlate with any observed stack trace containing bpf_probe_read_kernel_common.

What your security team should do

• Prioritize kernel updates on all production Linux hosts within standard change windows given low EPSS and no KEV listing
• Add BPF program load events to monitoring to detect anomalous iterator usage
• Test the fix in a lab environment using boundary nr_words values before broad rollout