Linux kernel BPF local storage race can escalate privileges
Original title: ZDI-26-1007: Linux Kernel BPF Local Storage Race Condition Local Privilege Escalation Vulnerability
ZDI rates the flaw CVSS 7.5 and says an attacker must already run high-privileged code.
ZDI published ZDI-26-1007, a race condition in Linux kernel BPF local storage that can let a local attacker escalate privileges. Exploitation requires the ability to execute high-privileged code on the target first. ZDI assigned CVSS 7.5. The notice does not name a CVE, affected versions, or a fix.
Unconfirmed: The notice does not identify a CVE or the affected kernel versions.
- The flaw is a race condition in BPF local storage.
- An attacker must already be able to run high-privileged code.
- ZDI assigned a CVSS rating of 7.5.
- No CVE or fixed version is stated.
Impact: Local privilege escalation
| Product | Affected |
|---|---|
| Linux Kernel | — |
- Products
- Linux Kernel
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.