CVE-2024-56768

What it actually does

Calling bpf_get_smp_processor_id() on a kernel built without CONFIG_SMP triggers a page fault because the helper references the unavailable pcpu_hot symbol, resulting in a kernel crash.

Why it matters to the business

Systems running non-SMP kernels that load or execute BPF programs using the affected helper may experience unexpected crashes, leading to service disruption and potential data loss in environments that disable SMP for performance or licensing reasons.

How an attack unfolds

An attacker with the ability to load or trigger BPF programs on a vulnerable non-SMP kernel invokes bpf_get_smp_processor_id() through a crafted program or eBPF-based tool, causing the kernel to dereference an invalid address and panic.

How to fix it

Upgrade the Linux kernel to a version containing commit f4ab7d74247b0150547cf909b3f6f24ee85183df or later; rebuild with CONFIG_SMP enabled where feasible; apply vendor-supplied updates for affected distributions.

How to confirm the fix worked

Confirm the running kernel contains commit f4ab7d74247b0150547cf909b3f6f24ee85183df via git log or uname; test that bpf_get_smp_processor_id() returns 0 without crashing on !CONFIG_SMP builds; review kernel build configuration to ensure the helper is inlined correctly.

Typical attack path

1. Identify or reach a Linux system running a kernel compiled without CONFIG_SMP
2. Obtain privileges sufficient to load or attach BPF programs
3. Craft or execute a BPF program that calls bpf_get_smp_processor_id()
4. Trigger the helper to induce the page fault and kernel crash

How to detect it

Search kernel logs for page fault messages referencing pcpu_hot or bpf_get_smp_processor_id; inspect audit logs for BPF program loads around the time of any kernel crashes; review system boot configuration for CONFIG_SMP presence.

What your security team should do

• Prioritize kernel updates on all non-SMP deployments within standard change windows
• Audit BPF program usage for calls to bpf_get_smp_processor_id()
• Enable CONFIG_SMP in future kernel builds unless explicitly required otherwise
• Monitor for kernel oops or page fault events referencing pcpu_hot on affected systems