CVE-2024-58070 is a vulnerability in the Linux kernel specifically related to the eBPF (extended Berkeley Packet Filter) subsystem's local storage implementation when running under the PREEMPT_RT (Real-Time) patch set. The issue arises because the kernel code incorrectly uses kmalloc with GFP_ATOMIC flags in contexts that are not safe for such atomic allocations in PREEMPT_RT environments. PREEMPT_RT modifies the Linux kernel to be fully preemptible, which changes the behavior and constraints around memory allocation and locking. The vulnerability is due to the use of kmalloc(GFP_ATOMIC) in non-preemptible contexts, which can lead to invalid sleeping function calls from atomic contexts, causing kernel bugs or crashes. The fix involves enforcing the use of bpf_mem_alloc instead of kmalloc in the bpf_local_storage code path when CONFIG_PREEMPT_RT is enabled. This ensures that memory allocation honors the constraints of the real-time kernel environment and prevents invalid context sleeps. The vulnerability has existed since the introduction of bpf_local_storage approximately five years ago, but this patch targets the bpf-next branch to correct the behavior going forward. The kernel logs included show a BUG triggered by a sleeping function called from an invalid context, with stack traces pointing to bpf_local_storage_update and related functions. The verifier ensures GFP_KERNEL flags are only passed in sleepable contexts, so the patch does not adjust gfp_flags but enforces the correct allocator usage. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, this vulnerability could lead to kernel crashes or instability on systems running Linux kernels with PREEMPT_RT enabled and using eBPF local storage features. PREEMPT_RT is commonly used in environments requiring real-time performance and low latency, such as industrial control systems, telecommunications infrastructure, automotive systems, and embedded devices. Organizations relying on such systems might experience denial of service conditions or system instability if this vulnerability is triggered, potentially disrupting critical operations. While no direct remote exploit is known, the vulnerability could be triggered by local users or processes with the ability to load or interact with eBPF programs, which are increasingly used for networking, monitoring, and security purposes. The impact on confidentiality and integrity is limited, as the vulnerability primarily causes kernel crashes rather than privilege escalation or data leakage. However, availability impact is significant in real-time or critical infrastructure contexts. European organizations in sectors like manufacturing, automotive, telecom, and critical infrastructure that deploy PREEMPT_RT patched Linux kernels should be particularly mindful of this issue.

1. Apply the official Linux kernel patch that enforces the use of bpf_mem_alloc in bpf_local_storage when CONFIG_PREEMPT_RT is enabled. This patch is available in the bpf-next branch and should be backported to stable kernels where PREEMPT_RT is used. 2. Update Linux kernels to versions that include this fix as soon as they are released by the distribution or vendor. 3. Audit and restrict the ability to load or run eBPF programs to trusted users and processes only, minimizing the attack surface. 4. Monitor kernel logs for BUG messages related to sleeping functions called from invalid contexts, which may indicate attempts to trigger this vulnerability. 5. For systems where PREEMPT_RT is not required, consider disabling it if feasible to reduce exposure. 6. Engage with Linux distribution vendors and real-time kernel maintainers to ensure timely patching and backporting of this fix. 7. In environments where real-time performance is critical, perform thorough testing of updated kernels to ensure stability and compatibility post-patch.