Monday, June 24, 2024

Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability

Google Project Zero researcher disclose the exploit and PoC(Proof of concept) for a serious Linux Kernel Vulnerability that affected Linux kernel version 3.16.

This bug was reported on earlier of this month by Google under 90-day disclosure deadline which allows an attacker could take over the complete control of the affected Linux system.

Google Project Zero’s young Security Expert Jann Horn discovered this serious cache invalidation vulnerability in Linux memory management.

The flaw (CVE-2018-17182), which exists in Linux memory management in kernel versions 3.16 through 4.18.8, can be exploited in many different ways, “even from relatively strongly sandboxed contexts,”

Linux Kernel Vulnerability & Exploitation

According to Jann , “Fundamentally, this bug can be triggered by any process that can run for a sufficiently long time to overflow the reference counter (about an hour if MAP_FIXED is usable) and has the ability to use mmap()/munmap() (to manage memory mappings) and clone() (to create a thread),”.

This bug mainly related to the Kernel’s virtual memory area(VMA) and caches that handling of kernel crashes is a tradeoff between availability, reliability, and security.

In this case, an attacker attempting to exploit a kernel bug might benefit from the ability to retry an attack multiple times without triggering system reboots  & read the crash log produced by the first attempt of the attack which will be used for the second sophisticated attacks.

“The bug was fixed by changing the [VMA] sequence numbers to 64 bits, thereby making an overflow infeasible and removing the overflow handling logic,”

Released Exploited described how much impact the kernel configuration can have on how easy it is to write an exploit for a kernel bug.

PoC (Proof-of-concept) was released on September 12 to the Linux kernel development  team and they fixed after 3 days.

The researcher warns that threat actors already developed the exploit for the vulnerability and the Linux distributions developers don’t publish kernel updates more often that very dangerous to the user who can easily vitimized.

Debian stable and Ubuntu releases 16.04 and 18.04 have not yet patched the vulnerability – and Android users remain at risk.

Related Read

New Xbash Malware Attack on Linux & Windows with Botnet, Ransomware & Coinminer Capabilities

Building a Hacking Kit with Raspberry Pi and Kali Linux

Gentoo Linux GitHub Account Hacked, Attackers Modified Repositories


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles