Linux Kernel: BPF Local Storage race condition may enable privilege escalation

ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.

At a glance
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage.
A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context.
Check the kernel version and compare it with the distribution vendor’s update information.

In this article

Zero Day Initiative published advisory ZDI-26-1007 about a flaw in Linux Kernel BPF Local Storage. See advisory ZDI-26-1007 for the source details.

Overview and technical details

The race condition is in the handling of bpf_local_storage_elem objects, where an appropriate lock is missing during operations on the object. The flaw is identified as ZDI-CAN-33360, with a recorded CVSS score of 7.5.

Field	Details
Product	Linux Kernel
Advisory and flaw ID	ZDI-26-1007; ZDI-CAN-33360
CVSS	7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Source	Zero Day Initiative

Affected systems

The advisory concerns Linux Kernel, but the dossier does not identify affected branches or a fixed version. Administrators should identify the kernel version in use and compare it with update information from the relevant distribution vendor.

Mechanism and impact

Before exploitation, an attacker must have the ability to execute highly privileged code on the system. Successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context.

System checks

Check the kernel version currently running. Record the result and compare it with the remedial update provided by the distribution vendor.
```
uname -r
```

Remediation and mitigation

Prioritize applying the Linux update released by the vendor to address the flaw. Identify the kernel version and compare it with update information for the distribution in use.
Refer to the related upstream change: commit 5bdd61e98da5468140aff5b5abc0e8544deaf2ee.