Monday, November 4, 2024
HomeCyber Security NewsGoogle Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability

Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability

Published on

Malware protection

Google Project Zero researcher disclose the exploit and PoC(Proof of concept) for a serious Linux Kernel Vulnerability that affected Linux kernel version 3.16.

This bug was reported on earlier of this month by Google under 90-day disclosure deadline which allows an attacker could take over the complete control of the affected Linux system.

Google Project Zero’s young Security Expert Jann Horn discovered this serious cache invalidation vulnerability in Linux memory management.

- Advertisement - SIEM as a Service

The flaw (CVE-2018-17182), which exists in Linux memory management in kernel versions 3.16 through 4.18.8, can be exploited in many different ways, “even from relatively strongly sandboxed contexts,”

Linux Kernel Vulnerability & Exploitation

According to Jann , “Fundamentally, this bug can be triggered by any process that can run for a sufficiently long time to overflow the reference counter (about an hour if MAP_FIXED is usable) and has the ability to use mmap()/munmap() (to manage memory mappings) and clone() (to create a thread),”.

This bug mainly related to the Kernel’s virtual memory area(VMA) and caches that handling of kernel crashes is a tradeoff between availability, reliability, and security.

In this case, an attacker attempting to exploit a kernel bug might benefit from the ability to retry an attack multiple times without triggering system reboots  & read the crash log produced by the first attempt of the attack which will be used for the second sophisticated attacks.

“The bug was fixed by changing the [VMA] sequence numbers to 64 bits, thereby making an overflow infeasible and removing the overflow handling logic,”

Released Exploited described how much impact the kernel configuration can have on how easy it is to write an exploit for a kernel bug.

PoC (Proof-of-concept) was released on September 12 to the Linux kernel development  team and they fixed after 3 days.

The researcher warns that threat actors already developed the exploit for the vulnerability and the Linux distributions developers don’t publish kernel updates more often that very dangerous to the user who can easily vitimized.

Debian stable and Ubuntu releases 16.04 and 18.04 have not yet patched the vulnerability – and Android users remain at risk.

Related Read

New Xbash Malware Attack on Linux & Windows with Botnet, Ransomware & Coinminer Capabilities

Building a Hacking Kit with Raspberry Pi and Kali Linux

Gentoo Linux GitHub Account Hacked, Attackers Modified Repositories

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...