CVE-2024-35860

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached solely through the local `bpf()` syscall — `BPF_PROG_LOAD` plus `BPF_LINK_CREATE` for a kprobe_multi/uprobe_multi link, then closing the link fd while the probes fire. No network or remote-peer input is involved anywhere on the path.

AC:LAttack complexity, low

The attacker controls both sides of the race: it picks which kernel/user functions are probed (including ones that block, so return-hooks fire arbitrarily late), drives them in a loop across all CPUs, and closes the link fd at will; three independent syzbot reproducers hit it in practice, so no condition outside attacker influence is required.

PR:LPrivileges required, low

Creating these links needs CAP_BPF+CAP_PERFMON, which `bpf_token_capable()` grants at `ns_capable()` level to a delegated BPF token inside a container, and which ordinary non-root tracing/observability service accounts routinely hold — that is a low-privileged account, not administrative control of the host.

UI:NUser interaction, none

The whole sequence — load program, create link, trigger the probes, close the fd — happens inside the attacker's own process. No action by any other user or administrator is needed.

S:UScope, unchanged

The use-after-free and everything it corrupts stay inside the kernel's own memory and privilege domain; no hypervisor, IOMMU, or other security-authority boundary is crossed.

C:HConfidentiality impact, high

`bpf_kprobe_multi_cookie()` bsearches the freed `addrs` array and returns `*cookie` from the freed `cookies` allocation directly to the running BPF program, which can exfiltrate it via a map — a read primitive over attacker-sprayed reclaimed slab, and the freed link is fully groomable.

I:HIntegrity impact, high

`kprobe_multi_link_prog_run()`/`uprobe_prog_run()` load `link->link.prog` out of freed memory and then indirect-call through it via `bpf_prog_run()`, and `fprobe_exit_handler()` calls `fp->exit_handler` from the same freed object — an attacker-controlled function-pointer dispatch giving control-flow hijack and full kernel-integrity compromise.

A:HAvailability impact, high

Even without weaponization, dereferencing and calling through the freed link produces a KASAN slab-use-after-free splat and a wild indirect branch — an immediate oops or panic — and the attacker can repeat the create/trigger/close cycle indefinitely.