Linux kernel BPF verifier: variable-size helper buffers skip write checks, allowing writes to read-only maps

CVSS 7.1CVE-2024-50164Kernel, userspace & hypervisorcurated

Impact

When a BPF helper gets a buffer whose size register is not a constant, the verifier skips its write checks (bounds checks still apply). A BPF program can then write into maps marked read-only, such as .rodata global maps. Anything that relies on BPF read-only data being immutable, for example the constants of eBPF-based networking, observability or security agents on the node, can have that data changed. The record rates the impact as high integrity and availability loss. It does not claim memory corruption outside the map or privilege escalation.

Who can reach it

Local. The attacker must be able to load BPF programs on the host (PR:L). On nodes where unprivileged BPF is disabled, that takes a privileged process or a container granted BPF capabilities.

What to do

Install a kernel that contains the stable fixes referenced in the record (or the distribution kernel that carries them, see the Debian LTS announcement), then drain and reboot each node. Until then, keep BPF loading limited to privileged users and do not give BPF capabilities to tenant containers.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-50164 https://git.kernel.org/stable/c/43f4df339a4d375bedcad29a61ae6f0ee7a048f8 https://git.kernel.org/stable/c/48068ccaea957469f1adf78dfd2c1c9a7e18f0fe https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.