CVE-2024-43910: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-43910 Overview

CVE-2024-43910 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The BPF verifier fails to call check_func_arg_reg_off() when validating arguments passed to global functions, allowing a modified CONST_PTR_TO_DYNPTR register to be passed as an argument. BPF helpers operating on this modified dynamic pointer trigger out-of-bounds memory accesses, detected by Kernel Address Sanitizer (KASAN) as slab-out-of-bounds reads in bpf_dynptr_data. The flaw impacts overall system stability and is classified under [CWE-787] (Out-of-Bounds Write).

Critical Impact
A local, low-privileged user capable of loading BPF programs can trigger out-of-bounds kernel memory access, resulting in kernel instability or denial of service.

Affected Products

Linux Kernel (mainline prior to the fix commit)
Linux Kernel stable branches prior to backported fixes
Distributions shipping vulnerable kernel versions with BPF enabled

Discovery Timeline

2024-08-26 - CVE-2024-43910 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43910

Vulnerability Analysis

The vulnerability resides in the BPF verifier logic that validates arguments passed to global BPF functions. Global functions accept an argument of type ARG_PTR_TO_DYNPTR | MEM_RDONLY, which represents a read-only dynamic pointer. The verifier neglects to invoke check_func_arg_reg_off() on this argument path, meaning a register carrying a CONST_PTR_TO_DYNPTR with a non-zero or attacker-controlled offset is accepted without validation.

Once inside the global function, BPF helpers such as bpf_dynptr_data() consume the modified pointer and dereference memory outside the intended object bounds. KASAN reporting confirms the read occurs beyond the allocated slab object, as shown in the kernel bug trace referencing bpf_dynptr_data+0x137/0x140. Additionally, process_dynptr_func() does not strictly type-match the supplied register, allowing register types other than PTR_TO_STACK or CONST_PTR_TO_DYNPTR to reach this code path.

Root Cause

The root cause is a missing verifier check on the register offset for dynamic pointer arguments to global functions. Without check_func_arg_reg_off(), the verifier trusts caller-supplied offsets, breaking the safety guarantees BPF helpers rely upon when computing memory addresses.

Attack Vector

Exploitation requires local access and the ability to load BPF programs, which typically demands CAP_BPF or CAP_SYS_ADMIN. An attacker crafts a BPF program that adjusts the offset of a CONST_PTR_TO_DYNPTR register and passes it to a global function. The subsequent helper call reads memory outside the intended dynptr buffer, corrupting kernel memory perception or causing a crash. No user interaction or network access is required. Full technical details are available in the kernel commit log.

Detection Methods for CVE-2024-43910

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in bpf_dynptr_data in kernel logs
Unexpected kernel oops or panic traces originating from bpf_user_ringbuf_drain or BPF trampoline frames
Unprivileged or service accounts loading BPF programs that manipulate dynptr offsets

Detection Strategies

Enable KASAN on test and staging kernels to surface out-of-bounds reads in BPF paths
Audit bpf() syscall usage and verifier rejections through kernel audit logs
Correlate BPF program load events with subsequent kernel warnings or crashes on the same host

Monitoring Recommendations

Collect dmesg and journal entries containing BUG: KASAN or bpf_dynptr strings for centralized analysis
Monitor processes invoking bpf() syscalls, especially those loading programs of type BPF_PROG_TYPE_TRACING or using user ring buffers
Track kernel version inventory to prioritize hosts still running unpatched builds

How to Mitigate CVE-2024-43910

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisory as soon as vendor-supplied builds are available
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrative users only
Set kernel.unprivileged_bpf_disabled=1 on systems where unprivileged BPF is not required

Patch Information

The fix adds check_func_arg_reg_off() to the verifier path handling ARG_PTR_TO_DYNPTR | MEM_RDONLY arguments and enforces that the register type is either PTR_TO_STACK or CONST_PTR_TO_DYNPTR. Patches are available in the mainline commit and the stable backport. Consult your distribution's security tracker for backported package versions.

Workarounds

Disable unprivileged BPF program loading via the kernel.unprivileged_bpf_disabled sysctl
Remove CAP_BPF from non-essential workloads and containers
Apply Seccomp or LSM policies that block the bpf() syscall for untrusted processes

bash

# Configuration example
# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify the setting
sysctl kernel.unprivileged_bpf_disabled