CVE-2024-40908: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40908 affects the Linux kernel's BPF subsystem, specifically related to the rawtp test_run interface. The vulnerability was discovered when syzbot reported a crash that occurs when a rawtp program executed through the test_run interface calls the bpf_get_attach_cookie helper or any other helper that touches the task->bpf_ctx pointer. The issue was identified on July 12, 2024 (NVD).

The vulnerability stems from a missing run context setting in the BPF rawtp test_run callback. When a program attempts to access the task->bpf_ctx pointer through helpers like bpf_get_attach_cookie, it can lead to a crash due to the uninitialized context. The fix involves setting the run context (task->bpf_ctx pointer) for the test_run callback by adding proper initialization and cleanup of the bpf_trace_run_ctx structure (Kernel Commit).

The vulnerability can cause a system crash (denial of service) when exploited through the BPF subsystem's test_run interface. This affects systems running vulnerable versions of the Linux kernel that utilize BPF programs with specific helper functions (Ubuntu).

The vulnerability can be triggered when a rawtp program is executed through the test_run interface and calls specific BPF helper functions. It requires local access to the system to exploit. The issue was initially reported by syzbot, indicating it was discovered through automated testing (Kernel Commit).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for multiple versions including 24.04 LTS (6.8.0-44.44), 22.04 LTS (5.15.0-121.131), and others. Users should update their kernel to the patched versions. The fix involves properly setting the run context for the rawtp test_run callback (Ubuntu).