CVE-2024-58060: 
Linux Kernel vulnerability analysis and mitigation

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel's bpf_struct_ops functionality when CONFIG_MODULES=n. The vulnerability, tracked as CVE-2024-58060, specifically affects the tcp_congestion_ops component that contains a 'struct module *owner' member. The issue was discovered and reported by Robert Morris, with the fix being implemented in early 2025 (Kernel Git).

The vulnerability occurs when bpf_struct_ops attempts to handle struct_ops that contain a 'struct module *owner' member. The issue manifests when CONFIG_MODULES=n, causing the btf_id of the 'struct module' to be missing, resulting in the warning 'WARN: resolve_btfids: unresolved symbol module'. This prevents bpf_try_module_get() from performing correct refcounting, potentially leading to a Use-After-Free condition. The CVSS v3.1 score for this vulnerability is 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability could potentially lead to a Use-After-Free condition in the Linux kernel when using bpf_struct_ops with CONFIG_MODULES disabled. This could result in system instability, potential privilege escalation, or system crashes. The high CVSS score indicates significant potential impact on system confidentiality, integrity, and availability (CISA-ADP).

The vulnerability requires local access and low privileges to exploit. It specifically affects systems where CONFIG_MODULES=n is set, which is noted as not being a common configuration. The vulnerability has been present since the beginning of bpf_struct_ops implementation (Kernel Git).

A fix has been implemented that rejects struct_ops registration if the struct_ops has the 'struct module *' member and the 'struct module' btf_id is missing. The patch includes moving the btf_type_is_fwd() helper to the btf.h header file for testing. The fix has been merged into the kernel codebase (Kernel Git).