Thursday, March 28, 2024

Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability

Google Project Zero researcher disclose the exploit and PoC(Proof of concept) for a serious Linux Kernel Vulnerability that affected Linux kernel version 3.16.

This bug was reported on earlier of this month by Google under 90-day disclosure deadline which allows an attacker could take over the complete control of the affected Linux system.

Google Project Zero’s young Security Expert Jann Horn discovered this serious cache invalidation vulnerability in Linux memory management.

The flaw (CVE-2018-17182), which exists in Linux memory management in kernel versions 3.16 through 4.18.8, can be exploited in many different ways, “even from relatively strongly sandboxed contexts,”

Linux Kernel Vulnerability & Exploitation

According to Jann , “Fundamentally, this bug can be triggered by any process that can run for a sufficiently long time to overflow the reference counter (about an hour if MAP_FIXED is usable) and has the ability to use mmap()/munmap() (to manage memory mappings) and clone() (to create a thread),”.

This bug mainly related to the Kernel’s virtual memory area(VMA) and caches that handling of kernel crashes is a tradeoff between availability, reliability, and security.

In this case, an attacker attempting to exploit a kernel bug might benefit from the ability to retry an attack multiple times without triggering system reboots  & read the crash log produced by the first attempt of the attack which will be used for the second sophisticated attacks.

“The bug was fixed by changing the [VMA] sequence numbers to 64 bits, thereby making an overflow infeasible and removing the overflow handling logic,”

Released Exploited described how much impact the kernel configuration can have on how easy it is to write an exploit for a kernel bug.

PoC (Proof-of-concept) was released on September 12 to the Linux kernel development  team and they fixed after 3 days.

The researcher warns that threat actors already developed the exploit for the vulnerability and the Linux distributions developers don’t publish kernel updates more often that very dangerous to the user who can easily vitimized.

Debian stable and Ubuntu releases 16.04 and 18.04 have not yet patched the vulnerability – and Android users remain at risk.

Related Read

New Xbash Malware Attack on Linux & Windows with Botnet, Ransomware & Coinminer Capabilities

Building a Hacking Kit with Raspberry Pi and Kali Linux

Gentoo Linux GitHub Account Hacked, Attackers Modified Repositories

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles