CVE-2024-56675

What it actually does

Use-after-free of bpf_prog structures because non-sleepable programs are freed under normal RCU while uprobe attachments run under tasks-trace-RCU, so a normal grace period does not guarantee the program is still valid when executed.

Why it matters to the business

Linux systems using BPF tracing or uprobes can experience kernel crashes, memory corruption, or local privilege escalation, disrupting services and requiring urgent patching across server fleets.

How an attack unfolds

An attacker loads a non-sleepable BPF program, attaches it to a uprobe, triggers execution paths that free the program under normal RCU, then reuses the freed memory during a subsequent uprobe event protected only by tasks-trace-RCU, achieving arbitrary kernel code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 9245459a992d22fe0e92e988f49db1fec82c184a or later; rebuild and reboot affected hosts. For packaged distributions apply the corresponding stable update that backports the RCU synchronization fix.

How to confirm the fix worked

Verify the running kernel contains the listed commit or a backport; inspect bpf_prog_put paths to confirm tasks-trace-RCU synchronization is present; test uprobe attachment of non-sleepable programs under load to ensure no UAF warnings appear in dmesg.

Typical attack path

1. Locate or create uprobe attachment points on the target system
2. Load a non-sleepable BPF program via bpf() syscall
3. Attach the program to the uprobe using perf_event_open or bpf_link
4. Trigger uprobe events while racing with program detachment and RCU grace periods
5. Exploit the resulting use-after-free for code execution or crash

How to detect it

Search kernel logs (dmesg, journalctl) for UAF reports, RCU stall warnings, or bpf_prog related faults around uprobe events; inspect audit logs for unusual bpf() and perf_event_open calls from untrusted processes.

What your security team should do

• Prioritize kernel updates on all systems exposing uprobes or using BPF tracing
• Disable unneeded uprobe attachments and restrict BPF program loading via LSM or capabilities
• Monitor kernel logs for RCU and BPF related warnings until patches are deployed