Details have surfaced about a newly identified security flaw in the Linux kernel that could allow a user to gain elevated privileges on a target host.
dubbing stack lot (CVE-2023-3269, CVSS score: 7.8), this flaw affects Linux versions 6.1 through 6.4. To date, there is no evidence that this shortcoming has been exploited.
“Since StackRot is a Linux kernel vulnerability found in the memory management subsystem, it affects almost all kernel configurations and requires minimal capabilities to trigger,” said Ruihan Li, a security researcher at Peking University. said Mr.
“Please note, however, that maple nodes are freed using RCU callbacks, so the actual memory deallocation is delayed until the RCU grace period has passed. Therefore, exploiting this vulnerability is difficult. presumably.”
Addressed in stable versions 6.1.37, 6.3.11 and 6.4.1 as of July 1, 2023 following a responsible disclosure on June 15, 2023 and a two week effort led by Linus Torvalds. rice field.
A proof-of-concept (PoC) exploit and additional technical details regarding this bug will be published by the end of this month.
The flaw is fundamentally rooted in a data structure called a maple tree. This data structure was introduced in Linux kernel 6.1 to replace the red-black tree (rbtree) to manage and store virtual memory areas (VMAs), which are contiguous ranges of virtual addresses. The contents of a file on disk, or the memory a program uses while it’s running.
🔐 Privileged Access Management: Learn How to Overcome Key Challenges
Discover different approaches to overcoming the challenges of privileged account management (PAM) and leveling up your privileged access security strategy.
reserve a spot
Specifically, this takes advantage of the fact that Maple Tree “can cause node replacements without properly acquiring the MM write lock”, which can be exploited by local users to compromise the kernel. , described as a use-after-free bug that could elevate privileges. . “
“Anyway, I’d really like to move all the stack extension code into its own brand new file instead of splitting it into mm/mmap.c and mm/memory.c , but this is the first maple tree anyway Since we backported it to the VMA deployment, we tried to keep the patches _pretty_ minimal,” said Torvalds.
