When a map is read-only for the ebpf program and is frozen, the ebpf verifier will directly take the value from the map and directly use the value to participate in the verification of the ebpf verifier. After the ebpf program passes the verification of the verifier, and then uses the race condition bug to modify the frozen map content, all the assumptions of the ebpf verifier will be invalid, and it may also lead to the problem of local privilege escalation.
When a map is read-only for the ebpf program and is frozen, the ebpf verifier will directly take the value from the map and directly use the value to participate in the verification of the ebpf verifier. After the ebpf program passes the verification of the verifier, and then uses the race condition bug to modify the frozen map content, all the assumptions of the ebpf verifier will be invalid, and it may also lead to the problem of local privilege escalation.
https://bugzilla.redhat.com/show_bug.cgi?id=2025645 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
Vulmon