Linux Kernel: vulnerability flaw under attack

What is affected

Linux Kernel is found on ordinary personal computers and phones, so this is not only a problem for companies. If you use it and have not updated since the fix was released, you are exposed.

Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.

What an attacker can do

This is a vulnerability flaw. It lets an attacker misuse the product in a way its maker did not intend. CISA lists it because attackers are confirmed to be using it against real systems.

How it is reached

Needs access to the device or a file opened on it

Access the attacker needs

A basic user account

Does the victim have to do something?

No, works without the victim doing anything

CISA records this vulnerability as known to be used in ransomware campaigns: attackers use it to get in, then encrypt files and demand payment.

What to do

1. Update Linux Kernel now. Open the update or "About" screen, install whatever is offered and restart the app or device, because the fix is not active until you do.
2. Turn on automatic updates so the next fix arrives without you having to look for it.
3. If your device is too old to receive this update, stop using the affected app for anything sensitive and plan a replacement.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor advisories and fixes

• git.kernel.orggit.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb7

How urgent is it

CISA added this vulnerability to its Known Exploited Vulnerabilities catalogue on September 9, 2024, which means there is reliable evidence of attacks in the wild. US federal agencies must fix it by September 30, 2024, a deadline that has already passed. That deadline does not bind anyone else, but it shows how seriously the agency rates it.

The EPSS model estimates a 11% probability that this flaw will be exploited somewhere in the next 30 days. That is higher than 96% of all scored vulnerabilities.

Its CVSS severity score is 7.8 out of 10 (high), as recorded in the US National Vulnerability Database.

Technical description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.