BPF Map Hash Calculation Requires Frozen State in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The issue is that the function bpf_map_get_info_by_fd calculates and caches a hash of a map without checking if the map is frozen (immutable). Because of this, there is a time-of-check to time-of-use (TOCTOU) bug where userspace can retrieve and cache the hash of the map, then modify the map's contents before freezing it. This allows a trusted loader to be tricked into verifying a stale hash while loading modified map contents.

The fix for this vulnerability is to require that the map be frozen before the hash is calculated. If the map is not frozen, the function returns an error (-EPERM), ensuring the hash is only generated for the final, immutable state of the map.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker or untrusted userspace process to trick a trusted loader into accepting a stale hash for a BPF map while the actual contents of the map have been modified. This can lead to the loading of unauthorized or malicious map contents, potentially compromising system integrity or security.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by requiring that the BPF map be frozen before calculating its hash, preventing TOCTOU attacks.

Immediate mitigation steps include ensuring your Linux kernel is updated to a version that includes this fix, which returns -EPERM if the map is not frozen when the hash is requested.

Useful 0 Not Useful 0