CVE-2024-58100

What it actually does

The Linux kernel BPF verifier fails to enforce compatibility of the changes_pkt_data flag when an extension program replaces a global sub-program, allowing mismatched packet pointer invalidation behavior during calls from main programs.

Why it matters to the business

Attackers can achieve local privilege escalation on Linux-based systems including Android devices, potentially compromising the entire kernel and enabling ransomware or spyware deployment; widespread kernel exposure increases urgency for patching.

How an attack unfolds

An attacker loads a malicious BPF extension program that replaces a global sub-program without matching the changes_pkt_data property, causing the verifier to incorrectly preserve or invalidate packet pointers; this is then triggered via crafted eBPF bytecode to corrupt kernel state and escalate privileges, as seen in campaigns by Advanced Spyware Campaign and related Linux kernel privilege escalation efforts.

How to fix it

Upgrade the Linux kernel to commit 7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7 or later; for Android devices apply the SoCVersion fix dated 2022-08-05 or newer vendor patches.

How to confirm the fix worked

Confirm the presence of the changes_pkt_data flag handling in bpf_check_attach_btf_id and check_cfg ordering by inspecting kernel source or running bpftool to verify program attachment constraints on patched systems.

Typical attack path

1. Identify a vulnerable Linux kernel with BPF support
2. Craft or load a malicious extension BPF program that mismatches changes_pkt_data
3. Attach the program to bypass verifier checks on packet data
4. Trigger execution paths that manipulate packet pointers
5. Exploit resulting kernel memory corruption for privilege escalation

How to detect it

Review kernel audit logs and BPF program load events for unusual extension program attachments; correlate with threat actor TTPs from Advanced Spyware Campaign targeting similar kernel flaws.

What your security team should do

• Immediately prioritize kernel upgrades to the fixed commit across all Linux and Android deployments due to privilege escalation risk
• Monitor for new BPF program loads using auditd or eBPF tracing tools
• Restrict unprivileged BPF access via sysctl kernel.unprivileged_bpf_disabled=1 where feasible