If you didn't update your Linux – you lost your computer.
Security researcher Notselwyn discovered a new vulnerability in Linux that allows you to get root rights. The bug affects versions of the Linux kernel from 5.14 to 6.6.14.
Vulnerability CVE-2024-1086 (CVSS score: 7.8) affects many popular distributions, including Debian, Ubuntu, Red Hat, and Fedora. An error related to double-freeing of memory in the netfilter component of the Linux kernel via nf_tables can cause the system to crash or execute arbitrary code. Linux kernel developers released patches to address the vulnerability in late January, and updates have been rolling out to users ever since.
Security researcher Notselwyn shared a detailed technical report on the bug, claiming that the exploit is successful in 99.4% of cases on the kernel version 6.4.16. Notselwyn expressed particular joy at the development of the project, emphasizing the excitement of first obtaining administrator rights using the discovered vulnerability.
The disadvantage allows you to use a double-release error in the nft_verdict_init () function, which can lead to a system crash or arbitrary code execution. The attack requires the non-privileged user namespaces option to access nf_tables to be enabled on the system, which is the default setting in many distributions.
The exploit technique, called Dirty Pagedirectory, allows an attacker to read and write to all pages of the system's memory without restrictions, giving full control over the vulnerable computer. The method is based on allocating the same kernel address for Page Upper Directory (PUD) and Page Middle Directory (PMD) using a double-release vulnerability.
The researcher shared a PoC exploit, which was described as "trivial" to launch. In other words, after overwriting the modprobe_path variable of the kernel, the exploit launches a shell with root rights, leaving the system completely under the control of the attacker.
Security researcher Notselwyn discovered a new vulnerability in Linux that allows you to get root rights. The bug affects versions of the Linux kernel from 5.14 to 6.6.14.
Vulnerability CVE-2024-1086 (CVSS score: 7.8) affects many popular distributions, including Debian, Ubuntu, Red Hat, and Fedora. An error related to double-freeing of memory in the netfilter component of the Linux kernel via nf_tables can cause the system to crash or execute arbitrary code. Linux kernel developers released patches to address the vulnerability in late January, and updates have been rolling out to users ever since.
Security researcher Notselwyn shared a detailed technical report on the bug, claiming that the exploit is successful in 99.4% of cases on the kernel version 6.4.16. Notselwyn expressed particular joy at the development of the project, emphasizing the excitement of first obtaining administrator rights using the discovered vulnerability.
The disadvantage allows you to use a double-release error in the nft_verdict_init () function, which can lead to a system crash or arbitrary code execution. The attack requires the non-privileged user namespaces option to access nf_tables to be enabled on the system, which is the default setting in many distributions.
The exploit technique, called Dirty Pagedirectory, allows an attacker to read and write to all pages of the system's memory without restrictions, giving full control over the vulnerable computer. The method is based on allocating the same kernel address for Page Upper Directory (PUD) and Page Middle Directory (PMD) using a double-release vulnerability.
The researcher shared a PoC exploit, which was described as "trivial" to launch. In other words, after overwriting the modprobe_path variable of the kernel, the exploit launches a shell with root rights, leaving the system completely under the control of the attacker.
