CVE-2024-38564: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-38564 affects the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The vulnerability was discovered and disclosed on June 19, 2024, and involves improper attach type enforcement in BPFLINKCREATE for BPFPROGTYPECGROUPSKB programs. The issue affects various Linux kernel versions and distributions (NVD).

The vulnerability stems from missing attach type enforcement in the linkcreate case for BPFPROGTYPECGROUPSKB programs. While bpfprogattach uses attachtypetoprogtype to enforce proper attach types, linkcreate relies on bpfprogattachcheckattachtype for verification. This missing enforcement allows cgroupskb prog types to be incorrectly attached to other cgroup hooks (Kernel Commit).

The vulnerability could allow improper program attachment in the Linux kernel's BPF subsystem, potentially leading to security implications when cgroup_skb program types are attached to incorrect cgroup hooks (NVD).

The vulnerability has been patched by adding proper attachtype enforcement for the linkcreate case. The fix involves adding verification code to ensure proper program type and attach type association. Users should update to patched kernel versions that include the fix (Kernel Commit).