CVE-2024-56720

What it actually does

Multiple bugs in sk_msg_shift_left and bpf_msg_pop_data within the Linux kernel BPF sockmap code, including missing put_page calls, absent early returns for zero-length operations, incorrect iterator advancement after shifts, and incomplete support for full message pops, resulting in memory corruption or kernel panics.

Why it matters to the business

Linux systems relying on BPF-based socket redirection or message manipulation may face kernel instability, crashes, or potential remote code execution, disrupting network services and increasing operational risk in high-performance environments.

How an attack unfolds

Attackers target Linux kernels using BPF sockmap by crafting programs or traffic patterns that invoke bpf_msg_pop_data with edge-case lengths or full-message pops, triggering the flawed shift and iteration logic to corrupt memory structures.

How to fix it

Apply the upstream kernel patches resolving the listed issues in bpf_msg_pop_data and sk_msg_shift_left; reboot systems after updating to a fixed kernel build.

How to confirm the fix worked

Confirm the patched kernel is running via uname, then exercise bpf_msg_pop_data paths with zero-length, full-message, and iterative cases in a test environment to verify absence of BUGs or panics.

Typical attack path

1. Locate systems running vulnerable kernels with active BPF sockmap usage
2. Deploy or trigger a BPF program exercising pop_data on sk_msg structures
3. Supply zero-length, full-size, or post-shift iterator inputs to hit the bugs
4. Leverage resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel logs for BUG or oops entries mentioning sk_msg_shift_left or bpf_msg_pop_data; inspect audit logs for unusual BPF program loads or sockmap usage around the time of crashes.

• sk_msg_shift_left
• bpf_msg_pop_data
• BUG: scheduling while atomic
• Unable to handle kernel paging request

What your security team should do

• Prioritize kernel updates on all systems using BPF sockmap or advanced networking
• Monitor for kernel oops or BUG reports related to sk_msg operations
• Restrict untrusted BPF program loading until patches are deployed