CVE-2024-47728: Linux Kernel Information Disclosure Flaw

CVE-2024-47728 Overview

CVE-2024-47728 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. Non-tracing BPF helpers that previously accepted ARG_PTR_TO_LONG or ARG_PTR_TO_INT arguments failed to zero the output value when the helper returned an error. The uncleared memory could leak kernel data back to the calling BPF program. The issue also affects Maximum Transmission Unit (MTU) helper functions where the mtu_len pointer is both read and written. The flaw is categorized as [CWE-459] Incomplete Cleanup and requires local, low-privileged access to load or invoke BPF programs to trigger it.

Critical Impact
A local user able to invoke affected BPF helpers can obtain uninitialized kernel memory contents, undermining kernel address confidentiality and enabling follow-on exploitation.

Affected Products

Linux Kernel (mainline branches prior to the fix commits listed by kernel.org)
Stable branches patched by commits 4b3786a6, 594a9f5a, 599d15b6, 8397bf78, and a634fa8e
Debian LTS distributions shipping vulnerable kernel packages

Discovery Timeline

2024-10-21 - CVE-2024-47728 published to NVD
2025-01 - Debian LTS security announcement released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47728

Vulnerability Analysis

The Linux kernel BPF verifier permits helper functions to receive pointer arguments annotated as ARG_PTR_TO_LONG or ARG_PTR_TO_INT. These annotations imply that the kernel will write a scalar result into the caller-provided memory. When a helper failed along an error path, it returned without initializing the destination scalar. The caller's memory therefore retained whatever kernel stack or map contents preceded the call.

BPF programs can read that memory back after invoking the helper. This yields an information disclosure primitive across a wide set of helpers that historically used these argument types. The commit message notes that tracing helpers such as bpf_get_func_arg() and bpf_get_func_ret() are excluded because CAP_PERFMON already grants broad kernel memory read access.

A related instance affects the MTU helpers. The mtu_len pointer is marked with MEM_UNINIT yet is both read and written by bpf_*_check_mtu(). Lifting MEM_UNINIT outright would reintroduce the ability to write into read-only maps such as .rodata, so the fix clears *mtu_len on the error path instead of reworking verifier semantics.

Root Cause

The root cause is incomplete cleanup on helper error paths. The helper contract assumed callers would only trust the output buffer on success, but the verifier did not enforce this and no explicit zeroing occurred. Combined with MEM_UNINIT semantics that conflate write-only intent with allowing uninitialized reads, the design leaves scalar output arguments containing stale kernel memory.

Attack Vector

Exploitation requires local access and the ability to load or execute BPF programs that call the affected helpers. The attacker crafts a BPF program that invokes a helper along a path guaranteed to fail, then reads the untouched output pointer to exfiltrate kernel memory. No user interaction is needed, and the flaw resolves entirely within the local kernel boundary. The vendor commits linked from kernel.org contain the authoritative fixes for each supported stable branch.

Detection Methods for CVE-2024-47728

Indicators of Compromise

Unexpected loading of BPF programs by non-root users or unprivileged containers on hosts that permit bpf() syscalls
BPF programs that invoke helpers returning error codes at unusually high rates, suggesting deliberate error-path probing
Kernel audit records showing bpf() syscall activity from workloads that do not normally use eBPF

Detection Strategies

Enable kernel auditd rules for the bpf syscall and correlate program load events with the invoking UID and container ID
Monitor kallsyms and /proc/kallsyms access alongside BPF program load activity to identify reconnaissance behavior
Compare running kernel versions against the fixed commit hashes published on kernel.org to identify vulnerable hosts

Monitoring Recommendations

Log all BPF_PROG_LOAD operations centrally and alert on loads from unexpected users, service accounts, or workloads
Track sysctl values such as kernel.unprivileged_bpf_disabled to detect drift that would broaden the attack surface
Baseline the set of production BPF programs and alert on any newly loaded program hashes

How to Mitigate CVE-2024-47728

Immediate Actions Required

Apply the distribution kernel update that incorporates the upstream fix commits referenced by kernel.org
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged users from loading BPF programs where operationally feasible
Restrict CAP_BPF, CAP_SYS_ADMIN, and CAP_PERFMON to trusted service accounts and audit their assignments

Patch Information

The fix zeroes the destination scalar on the error path for all non-tracing helpers that previously used ARG_PTR_TO_LONG or ARG_PTR_TO_INT, and clears *mtu_len in the MTU helpers on failure. Distribution patches are available in the Debian LTS Announcement and upstream in commits 4b3786a6, 594a9f5a, 599d15b6, 8397bf78, and a634fa8e.

Workarounds

Disable unprivileged BPF via the kernel.unprivileged_bpf_disabled sysctl on hosts that do not require unprivileged eBPF
Remove CAP_BPF from container runtime defaults and audit workloads that explicitly request it
Use seccomp profiles to block the bpf() syscall in workloads that have no legitimate need for it

bash

# Disable unprivileged BPF and persist across reboots
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf

# Verify the running kernel version against the patched commits
uname -r