CVE-2023-52621

What it actually does

Missing rcu_read_lock_trace_held() assertion in bpf_map_{lookup,update,delete}_elem helpers allows sleepable BPF programs running under the interpreter to invoke map operations without the required lock, triggering a kernel WARN_ON in helpers.c.

Why it matters to the business

Organizations running unpatched Linux kernels may experience unexpected kernel warnings or stability issues when using sleepable BPF programs for observability or networking, potentially requiring kernel updates across fleets and increasing operational overhead for systems relying on eBPF.

How an attack unfolds

An attacker with local access loads a sleepable BPF program that calls map helpers without holding the trace RCU lock while bpf_jit_enable=0; execution under the interpreter hits the missing assertion and emits the warning, which could be leveraged in combination with other bugs to disrupt kernel operation or for local denial of service.

How to fix it

Update the Linux kernel to the commit 82f2df94dac1aa9b879e74d1f82ba1b631bdc612 or later stable releases that include the added rcu_read_lock_trace_held() checks before the map helpers; rebuild and deploy the kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 82f2df94dac1aa9b879e74d1f82ba1b631bdc612, then execute test cases that load sleepable BPF programs calling map helpers under interpreter mode and verify no WARN_ON is emitted in dmesg.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Compile and load a sleepable BPF program that manipulates maps under interpreter mode
3. Trigger map helper calls without the trace RCU lock held
4. Observe kernel warning and potential follow-on instability

How to detect it

Search kernel logs (dmesg, syslog) for the exact warning string containing bpf_map_lookup_elem+0x54 and the call trace mentioning __bpf_prog_enter_sleepable_recur; inspect BPF program load events and any subsequent process crashes around PID values shown in the warning.

• WARNING: CPU.*PID.*at kernel/bpf/helpers.c:40
• bpf_map_lookup_elem+0x54/0x60
• __bpf_prog_enter_sleepable_recur
• bpf_trampoline.*bpf_map_lookup_elem

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems using sleepable BPF programs
• Enable JIT compilation (bpf_jit_enable=1) where feasible to reduce interpreter exposure
• Monitor kernel logs for the specific bpf_map_lookup_elem warning signature during rollout