CVE-2024-47794

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The entire attack is built and triggered through the local `bpf(2)` syscall — two `BPF_PROG_LOAD` calls, a `BPF_LINK_CREATE` freplace attach, a `PROG_ARRAY` map update, and `BPF_PROG_TEST_RUN`. No network peer or remote input is involved, and no netdev attachment is required.

AC:LAttack complexity, low

The attacker constructs every component of the loop (target prog, its bpf2bpf subprog, the freplace extension, and the prog_array entry) and fires it deterministically; there is no race, no memory-layout dependency, and no state outside the attacker's control. Every invocation reproduces the runaway tail-call chain.

PR:LPrivileges required, low

Loading `BPF_PROG_TYPE_EXT` goes through `bpf_token_capable()` for CAP_BPF/CAP_NET_ADMIN/CAP_PERFMON, which grants only `ns_capable()`-level checks when a BPF token is delegated to a user namespace via bpffs `delegate_cmds`/`delegate_progs` — so a low-privileged container process with a delegated token can reach it, and no real init-namespace root is strictly needed.

UI:NUser interaction, none

The attacker loads, attaches, and executes the programs entirely on its own via `BPF_PROG_TEST_RUN` or by attaching the classifier and sending itself a packet. No victim action of any kind is required.

S:UScope, unchanged

The corruption and the crash both occur in the kernel's own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.

C:HConfidentiality impact, high

The unbounded recursion is an out-of-bounds write past the kernel stack limit with attacker-chosen BPF stack contents; on builds without CONFIG_VMAP_STACK (e.g. KASAN_GENERIC configs, where `arch/Kconfig` disables it) the overflow spills into adjacent kernel memory, yielding a corruption primitive usable for disclosing kernel data.

I:HIntegrity impact, high

Same stack overflow gives an unbounded, attacker-controlled out-of-bounds write past the stack guard limit, which on non-VMAP_STACK configurations overwrites adjacent kernel structures and is leverageable for control-flow hijack; per guidance any OOB write scores High.

A:HAvailability impact, high

The commit states the tail-call mechanism "never terminate[s], eventually leading to a kernel panic" — the stack grows every cycle until it hits the guard page, producing an immediate double-fault panic (or silent corruption) within microseconds, and it can be re-triggered on every packet if the classifier is attached to a live interface.