CVE-2024-35917
📋 TL;DR
This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's BPF subsystem on s390x architecture. It allows local attackers to cause a kernel crash (denial of service) by triggering specific BPF operations. Systems running affected Linux kernel versions on IBM s390/s390x architecture are vulnerable.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel panic/crash, causing system-wide denial of service and potential data corruption.
Likely Case
Local denial of service through kernel crash when specific BPF operations are executed by an authenticated user.
If Mitigated
Minimal impact with proper access controls preventing unauthorized users from executing BPF operations.
🎯 Exploit Status
Exploitation requires local access and ability to execute BPF operations. The vulnerability was discovered through kernel testing rather than real-world exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 7ded842b356d151ece8ac4985940438e6d3998bb and c3062bdb859b6e2567e7f5c8cde20c0250bb130f
Vendor Advisory: https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. For custom kernels, apply commits 7ded842b356d151ece8ac4985940438e6d3998bb and c3062bdb859b6e2567e7f5c8cde20c0250bb130f. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable BPF subsystem
linuxDisable BPF functionality to prevent exploitation (may break applications relying on BPF)
echo 0 > /proc/sys/net/core/bpf_jit_enable
Add kernel boot parameter 'bpf_jit_enable=0' to GRUB configuration
Restrict BPF operations
linuxUse Linux capabilities or SELinux/AppArmor to restrict which users can execute BPF operations
setcap cap_bpf-ep /path/to/application (remove BPF capability)
Configure SELinux/AppArmor policies to deny bpf operations
🧯 If You Can't Patch
- Restrict local user access to systems, especially on s390x architecture
- Implement strict privilege separation and limit which users can execute BPF-related operations
🔍 How to Verify
Check if Vulnerable:
Check kernel version and architecture: uname -r and uname -m. If on s390x architecture with affected kernel version, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits: grep -q '7ded842b356d151ece8ac4985940438e6d3998bb\|c3062bdb859b6e2567e7f5c8cde20c0250bb130f' /proc/version_signature || echo 'Check kernel source'📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs mentioning BPF or s390/bpf
- System crash dumps with stack traces involving bpf_struct_ops_test_run or bpf_jit_plt
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("panic" OR "Oops") AND ("bpf" OR "s390")🔗 References
- https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb
- https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f
- https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e
- https://git.kernel.org/stable/c/7ded842b356d151ece8ac4985940438e6d3998bb
- https://git.kernel.org/stable/c/c3062bdb859b6e2567e7f5c8cde20c0250bb130f
- https://git.kernel.org/stable/c/d3d74e45a060d218fe4b0c9174f0a77517509d8e
