CVE-2024-58237

What it actually does

The vulnerability allows tail-called BPF programs to execute helpers that invalidate packet pointers without the verifier conservatively marking 'changes_pkt_data' effects, enabling unsafe post-tail-call accesses to packet data pointers in programs like those using bpf_tail_call_static.

Why it matters to the business

Linux-based systems and Android devices running affected kernels with eBPF networking programs face elevated risk of kernel instability, crashes, or security bypasses during packet processing; high ecosystem prevalence in servers, network appliances, and mobile devices amplifies operational disruption and potential data exposure.

How an attack unfolds

An attacker compiles and loads a malicious BPF program that performs a tail call to a subprogram, then dereferences a packet pointer previously obtained from sk->data; because the verifier no longer tracks invalidation across the tail call, the access succeeds and triggers memory corruption or information disclosure.

How to fix it

Upgrade the Linux kernel to a version containing commit f1692ee23dcaaddc24ba407b269707ee5df1301f; for Android devices apply the SoCVersion fix dated 2022-08-05 or later vendor patches.

How to confirm the fix worked

Confirm the patch is present by checking that bpf_helper_changes_pkt_data() now accounts for tail calls and that check_cfg() correctly propagates 'changes_pkt_data' for global subprograms; recompile and load test programs that previously triggered the unsafe pattern to ensure they are now rejected.

Typical attack path

1. Compile and load a crafted eBPF program containing bpf_tail_call_static followed by packet data dereference
2. Attach the program to a TC classifier or XDP hook on a network interface
3. Send crafted network packets that trigger the program path
4. Trigger verifier bypass leading to invalid pointer use after the tail call

How to detect it

Review kernel logs for BPF verifier messages referencing tail_call or changes_pkt_data; inspect loaded BPF programs via bpftool for tail calls followed by packet data accesses; correlate with unusual program attachment events in audit logs.

What your security team should do

• Immediately schedule kernel upgrades on all systems running eBPF programs with tail calls
• Audit custom BPF programs for use of tail calls and packet pointer assumptions
• Enable kernel BPF verifier logging and monitor for rejected programs during rollout
• Prioritize updates on high-traffic network devices given the 541 days since publication and rising EPSS trend