CVE-2021-4001

What it actually does

Race condition in the eBPF verifier between bpf_map_update_elem and bpf_map_freeze due to missing lock allows a privileged local user to modify a frozen map's address space.

Why it matters to the business

A local administrator or container runtime with BPF capabilities could alter protected kernel memory mappings, potentially leading to integrity violations or privilege escalation on affected systems; the issue is old with no active exploitation campaigns reported and limited downstream impact.

How an attack unfolds

An attacker with CAP_SYS_ADMIN or CAP_BPF first creates an eBPF map, races bpf_map_update_elem against bpf_map_freeze to bypass the freeze protection, and then modifies the now-frozen address space to corrupt kernel structures.

How to fix it

Upgrade affected Xen packages on Alpine v3.13 to version 4.14.5-r1 or later; for general Linux kernels apply patches that add the missing lock in kernel/bpf/syscall.c (versions 5.16-rc2 and newer).

How to confirm the fix worked

Confirm the running kernel or Xen package reports version 5.16-rc2+ or 4.14.5-r1+ respectively; inspect kernel source for the lock acquisition around bpf_map_update_elem and bpf_map_freeze; run eBPF map freeze/update stress tests to verify the race is closed.

Typical attack path

1. Obtain local access with CAP_SYS_ADMIN or CAP_BPF
2. Create eBPF map via bpf syscall
3. Trigger concurrent bpf_map_update_elem and bpf_map_freeze calls to win the race
4. Write to the now-mutable frozen map address space
5. Leverage the corruption for further kernel access or denial of service

How to detect it

Review kernel audit logs and eBPF-related syscalls for unusual map update patterns around freeze operations; no public exploit artifacts are known so focus on capability usage and map mutation events post-freeze.

What your security team should do

• Apply the listed package upgrades immediately on all Alpine Xen hosts
• Audit systems for any processes or containers holding CAP_SYS_ADMIN or CAP_BPF
• Restrict BPF usage via LSM or seccomp policies where possible
• Monitor for future kernel updates and schedule regular patching