CVE-2024-50063

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A privileged local attacker could exploit this by crafting BPF programs that improperly use "tail calls" to switch between different kernel function hooks. This bypasses critical security checks related to BPF program context or return values, potentially leading to information disclosure or privilege escalation.

The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:

cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that unprivileged eBPF usage is disabled. This can be achieved by setting the kernel.unprivileged_bpf_disabled sysctl to 1.

To check the current status: cat /proc/sys/kernel/unprivileged_bpf_disabled

To disable unprivileged eBPF usage for the current session: echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

To make this change persistent across reboots, create a file named /etc/sysctl.d/99-disable-unprivileged-bpf.conf with the following content: kernel.unprivileged_bpf_disabled = 1

Then, apply the changes: sysctl --system