CVE-2024-47703

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached by loading and attaching a crafted BPF LSM program through the local `bpf()` syscall and then triggering it with a local `open()`; there is no network or adjacent path into the verifier.

AC:LAttack complexity, low

Triggering is fully deterministic and entirely attacker-constructed — load an `SEC("lsm/file_alloc_security")` program that returns a chosen positive constant, attach it, then call `open()` — with no race, no dependence on uncontrolled memory layout, and `CONFIG_BPF_LSM` plus `"bpf"` in the default `CONFIG_LSM` list on mainstream distro and Android kernels.

PR:LPrivileges required, low

The attacker needs `CAP_BPF`+`CAP_PERFMON`, which were deliberately split out of `CAP_SYS_ADMIN` so BPF tracing/LSM could be granted to non-administrative principals (observability agents, sidecars, containers), and `bpf_token_capable()` resolves to `ns_capable(token->userns, ...)`, so with a delegating bpffs mount a user-namespace-confined non-root principal can load `BPF_LSM_MAC` programs. This is a constrained delegated privilege whose stated boundary is verifier soundness, not administrative control of the kernel.

UI:NUser interaction, none

The attacker performs every step in its own processes — load, attach, and then trigger with its own `open()` call. No victim action, mount, or file access by another user is required.

S:UScope, unchanged

Both the flawed component (BPF verifier return-value check) and the impacted component (VFS/kernel memory) are the kernel itself under a single security authority; no VM, IOMMU, or hypervisor boundary is crossed.

C:HConfidentiality impact, high

The unchecked positive return becomes an attacker-chosen `struct file *` in the `[1, 0x7FFFFFFF]` user range that `IS_ERR()` fails to reject, so a pre-mapped fake `struct file` with a controlled `f_op` yields arbitrary kernel-memory reads and disclosure; the verifier bypass also lets LSM access-control verdicts be forged, defeating confidentiality enforcement.

I:HIntegrity impact, high

A verifier-sanctioned out-of-contract return value hands the VFS a fully attacker-controlled `struct file`, the canonical primitive for arbitrary kernel write and control-flow hijack via `f_op` after `fd_install()`, and independently allows LSM allow/deny decisions to be forged.

A:HAvailability impact, high

The commit message documents that a positive `file_alloc_security` return "makes kernel panic" because the filesystem dereferences it as a file pointer; any `open()` on the system then oopses, giving a trivially repeatable full denial of service.