CVE-2024-58100 bpf: check changes_pkt_data property for extension programs
A missing check in the Linux kernel BPF verifier allows extension programs to bypass packet data change validation, potentially leading to memory corruption or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58100?
CVE-2024-58100 is a high-severity vulnerability in Linux kernel, published on 5 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: check changes_pkt_data property for extension programs
When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changes_pkt_data property of the global sub-program.
Because of this, an extension program replacing a global sub-program must be compatible with changes_pkt_data property of the sub-program being replaced.
This commit: - adds changes_pkt_data flag to struct bpf_prog_aux: - this flag is set in check_cfg() for main sub-program; - in jit_subprogs() for other sub-programs; - modifies bpf_check_attach_btf_id() to check changes_pkt_data flag; - moves call to check_attach_btf_id() after the call to check_cfg(), because it needs changes_pkt_data flag to be set:
bpf_check: ... ... - check_attach_btf_id resolve_pseudo_ldimm64 resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded bpf_prog_is_offloaded check_cfg check_cfg + check_attach_btf_id ... ...
The following fields are set by check_attach_btf_id(): - env->ops - prog->aux->attach_btf_trace - prog->aux->attach_func_name - prog->aux->attach_func_proto - prog->aux->dst_trampoline - prog->aux->mod - prog->aux->saved_dst_attach_type - prog->aux->saved_dst_prog_type - prog->expected_attach_type
Neither of these fields are used by resolve_pseudo_ldimm64() or bpf_prog_offload_verifier_prep() (for netronome and netdevsim drivers), so the reordering is safe.
Which versions are affected by CVE-2024-58100?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58100?
Apply the vendor's patch.
Is CVE-2024-58100 being exploited?
There is no known exploitation of CVE-2024-58100 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-69929, BELL-CVE-2024-58100, DEBIAN-CVE-2024-58100, GHSA-28h8-49pj-mw67, ROOT-OS-DEBIAN-11-CVE-2024-58100, ROOT-OS-DEBIAN-12-CVE-2024-58100 and 3 more.