Researchers Uncover New Linux Kernel ‘StackRot’ Privilege Escalation Vulnerability

Facts have emerged about a newly discovered security flaw in the Linux kernel that could allow a user to get elevated privileges on a focus on host.

Dubbed StackRot (CVE-2023-3269, CVSS score: 7.8), the flaw impacts Linux versions 6.1 by means of 6.4. There is no evidence that the shortcoming has been exploited in the wild to day.

“As StackRot is a Linux kernel vulnerability discovered in the memory administration subsystem, it impacts practically all kernel configurations and necessitates negligible abilities to result in,” Peking College security researcher Ruihan Li claimed.

“On the other hand, it ought to be mentioned that maple nodes are freed making use of RCU callbacks, delaying the true memory deallocation until eventually just after the RCU grace interval. For that reason, exploiting this vulnerability is viewed as hard.”

Subsequent responsible disclosure on June 15, 2023, it has been tackled in secure variations 6.1.37, 6.3.11, and 6.4.1 as of July 1, 2023, right after a two-7 days effort and hard work led by Linus Torvalds.

A proof-of-notion (PoC) exploit and supplemental technical specifics about the bug are predicted to be built community by the stop of the month.

The flaw is effectively rooted in a facts composition termed maple tree, which was introduced in Linux kernel 6.1 as a substitution for crimson-black tree (rbtree) to regulate and retail store virtual memory areas (VMAs), a contiguous range of virtual addresses that could be the contents of a file on disk or the memory a application takes advantage of for the duration of execution.

Future WEBINAR🔐 Privileged Access Management: Find out How to Conquer Critical Challenges

Uncover distinctive approaches to conquer Privileged Account Administration (PAM) problems and amount up your privileged obtain security method.

Reserve Your Spot

Specifically, it truly is explained as a use-just after-free of charge bug that could be exploited by a local person to compromise the kernel and escalate their privileges by using advantage of the point that the maple tree “can go through node replacement devoid of correctly attaining the MM create lock.”

“Anyway, I believe I want to truly go all the stack enlargement code to a whole new file of its personal, alternatively than have it split up amongst mm/mmap.c and mm/memory.c, but considering that this will have to be backported to the preliminary maple tree VMA introduction in any case, I experimented with to keep the patches _relatively_ nominal,” Torvalds pointed out.

Identified this article intriguing? Comply with us on Twitter  and LinkedIn to browse a lot more unique material we article.

Some parts of this article are sourced from:
thehackernews.com