CVE-2024-53099

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A missing validation check on link types in the link file descriptor information handler can result in an out-of-bounds read. A local user could exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive kernel memory.

The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command:

# cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable unprivileged access to the eBPF subsystem via sysctl:

1. Apply the setting immediately:

sysctl -w kernel.unprivileged_bpf_disabled=1

2. To persist this setting across system reboots, write the configuration to /etc/sysctl.d/:

echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/50-unprivileged_bpf.conf

sysctl --system

Caveats: This setting prevents processes without CAP_SYS_ADMIN or CAP_BPF capabilities from utilizing eBPF features. Unprivileged eBPF is already disabled by default on supported versions of Red Hat Enterprise Linux. This mitigation does not restrict privileged processes or root users. Applying the sysctl takes effect immediately without requiring a system reboot.