CVE-2024-45020: Linux Kernel Use-After-Free Vulnerability

CVE-2024-45020 Overview

CVE-2024-45020 is an out-of-bounds memory access vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The flaw resides in the stacksafe() function within the BPF subsystem. Daniel Hodges reported the issue while experimenting with the sched-ext extensible scheduler class. The bug triggers when the current verifier state has a smaller allocated_stack than the older state being compared, allowing loop iteration to read past the bounds of cur->stack[]. Exploitation requires local access and privileges sufficient to load BPF programs. Successful triggering crashes the kernel and produces a denial-of-service condition on affected systems running Linux 6.11 release candidates and other maintained branches.

Critical Impact
A local user able to invoke the BPF verifier can trigger a kernel crash through an out-of-bounds read in stacksafe(), resulting in denial of service [CWE-787].

Affected Products

Linux Kernel 6.11-rc1
Linux Kernel 6.11-rc2
Linux Kernel 6.11-rc3

Discovery Timeline

2024-09-11 - CVE-2024-45020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45020

Vulnerability Analysis

The Linux kernel BPF verifier statically analyzes BPF programs before they run in kernel context. During state comparison, stacksafe() walks the stack slots of a previously recorded verifier state (old) and compares them against the current state (cur). The loop index i iterates up to old->allocated_stack. When cur->allocated_stack is smaller than old->allocated_stack, the code dereferences cur->stack[spi].slot_type[i % BPF_REG_SIZE] beyond the allocated stack array. This out-of-bounds read corrupts verifier state or triggers a kernel oops. The bug surfaced when Daniel Hodges exercised sched-ext workloads that produced verifier states with mismatched stack allocations. Reproducing the crash requires the ability to submit BPF programs, which typically requires CAP_BPF or CAP_SYS_ADMIN, though unprivileged BPF may be enabled on some distributions.

Root Cause

The root cause is missing bounds validation in kernel/bpf/verifier.c. The comparison loop assumes both states have equivalent stack allocation sizes. It does not verify that i remains within cur->allocated_stack before indexing cur->stack[]. This constitutes a classic out-of-bounds read [CWE-787] against a dynamically sized array.

Attack Vector

A local, authenticated attacker crafts a BPF program that induces the verifier to produce state pairs where the newer state has a smaller allocated stack than a previously cached state. When the verifier reaches stacksafe() for state pruning comparisons, the out-of-bounds access triggers a kernel crash. The attack requires local access and BPF submission privileges. No remote or unauthenticated path exists. The impact is limited to availability; confidentiality and integrity are not affected because the read targets unmapped or unrelated kernel memory rather than exposing controlled data.

See the upstream fix commit bed2eb9 for the exact verifier code path.

Detection Methods for CVE-2024-45020

Indicators of Compromise

Kernel oops or panic messages referencing stacksafe, regsafe, or states_equal in kernel/bpf/verifier.c.
Unexpected system reboots on hosts that permit unprivileged users to load BPF programs.
dmesg entries showing a general protection fault or page fault triggered during a bpf(BPF_PROG_LOAD) syscall.

Detection Strategies

Audit kernel version strings across the fleet and flag hosts running Linux 6.11-rc1 through 6.11-rc3 or unpatched development branches.
Correlate crash telemetry with recent bpf() syscall activity from non-root or containerized workloads.
Review sched-ext program loads and other complex BPF workloads that produce large or variable stack usage.

Monitoring Recommendations

Enable kdump or equivalent crash-capture tooling to preserve verifier stack traces for triage.
Log all bpf() syscalls via auditd rules targeting SYS_bpf, capturing UID, command, and program type.
Alert on repeated kernel faults originating from the same process or container to detect exploitation attempts.

How to Mitigate CVE-2024-45020

Immediate Actions Required

Update the Linux kernel to a version containing the fix from commits bed2eb9, 7cad317, or 6e3987a on the appropriate stable branch.
Restrict BPF program loading to trusted users by setting kernel.unprivileged_bpf_disabled=1 via sysctl.
Remove CAP_BPF and CAP_SYS_ADMIN from container runtimes and service accounts that do not require them.

Patch Information

The fix adds an i >= cur->allocated_stack bounds check in stacksafe() so the function returns false before performing the out-of-bounds access. Patches are available in three upstream commits: 6e3987a, 7cad317, and bed2eb9. Distribution vendors have backported the fix into stable kernel series; apply vendor updates as they become available.

Workarounds

Disable unprivileged BPF loading system-wide with sysctl -w kernel.unprivileged_bpf_disabled=1 and persist the setting in /etc/sysctl.d/.
Avoid deploying sched-ext or other experimental BPF schedulers on unpatched kernels.
Use seccomp or LSM policies to block the bpf() syscall from workloads that do not legitimately require it.

bash

# Disable unprivileged BPF program loading
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf
sudo sysctl --system

# Verify the setting
sysctl kernel.unprivileged_bpf_disabled