Privilege escalation in Linux kernel bpf

1) Race condition

EUVDB-ID: #VU88938

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26737

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the bpf_timer_cancel_and_free and bpf_timer_cancel calls in kernel/bpf/helpers.c. A local user can exploit the race and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/5268bb02107b9eedfdcd51db75b407d10043368c
http://git.kernel.org/stable/c/addf5e297e6cbf5341f9c07720693ca9ba0057b5
http://git.kernel.org/stable/c/8327ed12e8ebc5436bfaa1786c49988894f9c8a6
http://git.kernel.org/stable/c/7d80a9e745fa5b47da3bca001f186c02485c7c33
http://git.kernel.org/stable/c/0281b919e175bb9c3128bd3872ac2903e9436e3f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.