CVE-2024-56702

What it actually does

The BPF verifier incorrectly marks raw tracepoint arguments as trusted non-NULL pointers, allowing explicit NULL checks to be optimized away and permitting unsafe dereferences or pointer arithmetic that can crash the kernel.

Why it matters to the business

Affected Linux systems face kernel instability, crashes, or privilege escalation risks, especially in environments using raw tracepoints; urgency is elevated by observed exploitation in espionage and financially motivated campaigns despite low EPSS.

How an attack unfolds

An attacker compiles and loads a BPF program attaching to a raw tracepoint where the argument can legitimately be NULL; the verifier's flawed trust assumption removes safety checks, enabling a NULL dereference that results in a crash or escalation when the pointer is accessed. Related campaigns by espionage actors and privilege escalation exploits on Linux kernels demonstrate active targeting.

How to fix it

Upgrade to fixed package versions including apache2 (Ubuntu:14.04:LTS) fixed in 2.4.7-1ubuntu4.15 and apache2 (Ubuntu:16.04:LTS) fixed in 2.4.18-2ubuntu3.2; apply the kernel patch marking raw_tp arguments PTR_MAYBE_NULL while preserving PROBE_MEM and trusted_reg handling for raw_tp programs only.

How to confirm the fix worked

Confirm updated kernel and BPF verifier behavior by running the tp_btf_nullable selftest to ensure direct dereference of nullable raw tracepoint arguments no longer triggers verifier rejection; inspect loaded programs for correct NULL-check preservation.

Typical attack path

1. Identify systems running vulnerable kernels with BPF enabled
2. Develop or obtain a BPF program using raw tracepoints without NULL guards
3. Load the program via bpf() syscall to bypass verifier protections
4. Trigger the tracepoint with a NULL argument to induce memory corruption
5. Escalate privileges or cause denial of service

How to detect it

Search kernel logs, auditd, and BPF event traces for NULL pointer dereference faults during raw tracepoint execution; correlate with bpf program loads by untrusted users and review selftest or verifier logs for changes in nullable argument handling. Watch for indicators tied to listed espionage and financial campaigns exploiting similar kernel issues.

• bpf_raw_tp
• PTR_MAYBE_NULL
• tp_btf_nullable
• mask_raw_tp_trusted_reg

What your security team should do

• Immediately apply available kernel updates given the 653 days since publication and listed threat actor activity
• Restrict unprivileged BPF program loading via sysctl or LSM policies
• Monitor kernel logs for oops/panic traces involving raw tracepoints or bpf_raw_tp
• Audit custom BPF programs for raw_tp argument handling