CVE-2024-26588
📋 TL;DR
A memory access vulnerability in the Linux kernel's BPF JIT compiler for LoongArch architecture allows out-of-bounds memory access when processing large BPF programs. This can lead to kernel crashes or potential privilege escalation. Systems running Linux kernels with LoongArch support and BPF enabled are affected.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service, or potential privilege escalation to kernel mode if combined with other vulnerabilities.
Likely Case
Kernel crash/panic when loading specific BPF programs, causing system instability or denial of service.
If Mitigated
No impact if BPF is disabled or systems aren't using LoongArch architecture.
🎯 Exploit Status
Test case (test_tag) demonstrates crash. Exploitation requires CAP_BPF capability or root access to load BPF programs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 36a87385e31c9343af9a4756598e704741250a67 and related fixes
Vendor Advisory: https://git.kernel.org/stable/c/36a87385e31c9343af9a4756598e704741250a67
Restart Required: Yes
Instructions:
1. Update kernel to patched version from your distribution. 2. For custom kernels, apply commits 36a87385e31c9343af9a4756598e704741250a67 and related fixes. 3. Reboot system.
🔧 Temporary Workarounds
Disable BPF JIT compilation
linuxPrevents JIT compilation of BPF programs, mitigating the vulnerability
echo 0 > /proc/sys/net/core/bpf_jit_enable
Restrict BPF program loading
linuxLimit BPF program loading capabilities using Linux capabilities
setcap -r /path/to/binary cap_bpf
cap_sys_admin
🧯 If You Can't Patch
- Disable BPF JIT via sysctl: net.core.bpf_jit_enable=0
- Implement strict capability controls to prevent unauthorized BPF program loading
🔍 How to Verify
Check if Vulnerable:
Check if system uses LoongArch architecture and has BPF enabled: 'uname -m' should show loongarch64 and 'cat /proc/sys/net/core/bpf_jit_enable' should show 1Check Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: 'uname -r' and verify with distribution patch notes📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages mentioning 'Unable to handle kernel paging request' with BPF/JIT context
- System crashes when loading BPF programs
Network Indicators:
- None - local vulnerability
SIEM Query:
kernel: "Unable to handle kernel paging request" AND ("BPF" OR "JIT" OR "test_tag")🔗 References
- https://git.kernel.org/stable/c/36a87385e31c9343af9a4756598e704741250a67
- https://git.kernel.org/stable/c/4631c2dd69d928bca396f9f58baeddf85e14ced5
- https://git.kernel.org/stable/c/7924ade13a49c0067da6ea13e398102979c0654a
- https://git.kernel.org/stable/c/9aeb09f4d85a87bac46c010d75a2ea299d462f28
- https://git.kernel.org/stable/c/36a87385e31c9343af9a4756598e704741250a67
- https://git.kernel.org/stable/c/4631c2dd69d928bca396f9f58baeddf85e14ced5
- https://git.kernel.org/stable/c/7924ade13a49c0067da6ea13e398102979c0654a
- https://git.kernel.org/stable/c/9aeb09f4d85a87bac46c010d75a2ea299d462f28
