CVE-2024-27050: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-27050) was discovered in the libbpf component, specifically in the bpf_xdp_query() function. The issue was identified and disclosed in May 2024, affecting the Linux kernel's BPF (Berkeley Packet Filter) subsystem (Kernel Git).

The vulnerability stems from improper field assignments in the bpf_xdp_query_opts structure. When the feature_flags and xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro. This caused libbpf to write to these fields unconditionally, which means that programs compiled against an older version of libbpf (with a smaller size of the bpf_xdp_query_opts struct) would have their stack corrupted by libbpf writing out of bounds. According to CISA's assessment, this vulnerability has a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to stack corruption in programs compiled against older versions of libbpf when interacting with the bpf_xdp_query() function. This could potentially result in system instability or denial of service conditions (Kernel Git).

The vulnerability requires local access and low privileges to exploit. It primarily affects systems where programs are compiled against older versions of libbpf while interacting with newer kernel versions that include the affected code (NVD).

The issue has been fixed by modifying the code to use the OPTS_SET() macro for both feature_flags and xdp_zc_max_segs field assignments. The fix ensures proper bounds checking when writing to these fields. The patch has been merged into the Linux kernel and is available in updated versions (Kernel Git).