Security1 publisher2 min readPublished
Asim Manizada published working local-root exploits for four freshly patched Linux kernel bugs
The fixes are already upstream, so the work now is confirming your distribution shipped them before someone with a low-privileged shell on a shared host uses the published code to reach root.
The Watch · Security desk
What happened
- Asim Manizada reported four Linux kernel flaws to the kernel security team in mid-July and published a write-up with working local-root exploits on September 18, after a hold agreed with the distributions.
- He named them DirtyAH6, TUNderflow, PPPoEject and DiagSpill, and each one takes an ordinary local user to root on an unpatched kernel.
- Kernel maintainers fixed all four over the past few weeks, so a host running an up-to-date kernel is not affected by the released code.
- Three of the four are reachable by an ordinary user only where unprivileged user namespaces are enabled, which many distributions do by default.
- There are no reports so far of any of the four being used in real-world attacks.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure On a multi-user or multi-tenant host, an attacker who already holds a low-privileged account now has published code that finishes the job; the foothold is the only prerequisite left.
- decision Operators who cannot reboot into a new kernel this week have to decide whether a partial mitigation is worth it, because disabling unprivileged user namespaces still leaves DiagSpill open.
- constraint Confirming you are covered is an advisory-reading exercise for every distribution in the fleet, since a distro kernel's version number says nothing useful about which of the four backports it carries.
- capability Anyone reusing the code inherits a working template for kernel memory corruption and still has to retune it for the target build, which is the remaining work between publication and a usable intrusion tool.
All four are memory-safety bugs in different parts of the kernel's networking code, and each one lets a local user corrupt kernel memory; Manizada turned that corruption into a root shell in every case [9]. The underlying mistakes are 10 to 21 years old [10], so the faulty code went in somewhere between roughly 2005 and 2016 [3].
DirtyAH6 is in the IPsec code for the IPv6 Authentication Header. It trusted a routing-header field without verifying it against the number of addresses actually present, so a crafted packet pushed an internal pointer far out of bounds and wrote past the buffer [11]. TUNderflow is in the TUN and TAP virtual network devices, where a single value was used both as spare space and as a size; an oversized value passed in through Open vSwitch made the size calculation wrap around, and packet data landed outside its buffer [12].
Two of the four can be triggered over the network, in narrow cases and mainly to crash the target [7]. DirtyAH6 can crash a host that acts as an IPv6 router or gateway and adds an IPsec Authentication Header in transport mode [13]. DiagSpill can crash a host only when certain SCTP options that are off by default have been switched on [14]. Manizada reached remote root with DirtyAH6 in his own lab, and only by shaping memory on the target first [15]. Doing that from a remote position alone, he wrote, "looks extremely difficult," though he did not rule it out [16]. For DiagSpill he said he sees no path to remote root at all, even with perfect memory shaping [17]. He also said the flaws could in theory let an attacker escape a container, and that he did not build one [18].
Distributions had roughly two months of notice before the code went public [1]. Upstream, the first stable releases carrying all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4 [23]. Those numbers will not match what is installed on most machines: Debian, Ubuntu, Red Hat and SUSE ship their own kernel versions and add the fixes on their own schedules, so the check is a distribution advisory confirming all four [21].
On hosts that cannot take a kernel reboot yet, switching off unprivileged user namespaces closes the ordinary-user path to DirtyAH6, TUNderflow and PPPoEject. It leaves DiagSpill, which needs only an available SCTP module [6], and it does not stop a container or process that already holds network-admin privileges [24]. Manizada recommends patching over turning features off, because other paths to the same flaws may exist [22].
What to watch
- Distribution advisories from Debian, Ubuntu, Red Hat and SUSE confirming all four fixes are in their shipped kernels.
- The first report of any of the four used in an intrusion, or a version of the exploit code ported beyond the builds Manizada targeted.
- A working container escape built on DirtyAH6, TUNderflow, PPPoEject or DiagSpill, which Manizada said is possible in theory but did not build.