CVE-2024-50262

What it actually does

The vulnerability allows an out-of-bounds write in trie_get_next_key() because the node stack is allocated with size trie->max_prefixlen but up to max_prefixlen + 1 nodes can be written when traversing full paths from root to leaves in the BPF trie structure.

Why it matters to the business

Attackers with local access can potentially corrupt memory leading to system crashes, data integrity issues, or elevation of privileges on affected Linux systems, increasing risk in environments with high prevalence of kernel usage.

How an attack unfolds

An attacker with local privileges crafts a BPF trie with specific prefix lengths and calls trie_get_next_key with a key of full prefix length, causing the stack overflow write and potential memory corruption that can be leveraged for further exploitation, consistent with patterns seen in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors.

How to fix it

Update to fixed kernel versions or apply patches that correct the stack allocation size in trie_get_next_key(). For affected products upgrade flashplugin-nonfree to version 11.2.202.535ubuntu0.14.04.1.

How to confirm the fix worked

Verify kernel version is updated and test BPF trie operations with max prefix lengths to ensure no crashes or corruption.

Typical attack path

1. Obtain local access to the system
2. Load or interact with BPF programs using trie maps
3. Trigger trie_get_next_key with crafted keys
4. Exploit the out-of-bounds write for memory corruption
5. Escalate privileges or cause denial of service

How to detect it

Look for unusual BPF map operations or kernel oops/panics related to trie_get_next_key in system logs, especially in contexts matching Linux Kernel Out-of-Bounds Write Vulnerability patterns.

What your security team should do

• Prioritize patching systems with local user access due to memory corruption risk
• Monitor for BPF related anomalies in logs
• Limit untrusted BPF program loading if possible