Technical information has emerged about a serious vulnerability affecting many versions of the Linux kernel that can be activated with minimal capabilities. This security issue is referred to as “StackRot” (CVE-2023-3269) and can be used to compromise the kernel, allowing an attacker to escalate privileges.
See also: RedEnergy: Stealer-as-a-Ransomware targeting energy and telecommunications sectors
An update is available for affected stable kernels as of July 1, while full details about the issue along with a full exploit code are expected by the end of the month.
Security researcher Ruihan Li discovered and reported the vulnerability in a post today. He explains that it affects the kernel's memory management subsystem, a component responsible for implementing virtual memory and demand paging, allocating memory for the needs of both the kernel and user-space programs, and mapping files to the process address space.
See also: Microsoft Teams: TeamsPhisher tool exploits bug
StackRot affects all kernel configurations in Linux versions 6.1 to 6.4.
Although Li submitted the vulnerability report on June 15, creating a fix took nearly two weeks due to its complexity, and Linus Torvalds led the effort.
StackRot details
StackRot results from the handling of stack expansion by the Linux kernel in the memory management subsystem, which is linked to the management of virtual memory areas (VMAs).
Specifically, the vulnerability lies in the “Maple Tree”, a new data structure system for VMAs introduced in the Linux 6.1 kernel, which replaced the “Red-Black Trees” and was based on the Read-Copy-Update (RCU) mechanism.
The vulnerability is a use-after-free (UAF) issue stemming from the way stack expansion was handled, as the maple tree could replace a node without acquiring the memory management (MM) write lock.
As the Linux kernel expands the stack and removes the gap between VMAs, a new node is created in the “maple tree” and the old one is marked for deletion after the end of the current reads, due to the maple tree's RCU safety.
However, during the RCU grace period, a use-after-free issue may arise when a process accesses the old node, thus creating an exploitable context for privilege escalation.
See also: Hacker believed to be a member of the OPERA1ER group arrested
The exploit is coming
Ruihan Li notes that exploiting StackRot is a difficult task and that CVE-2023-3269 may be the first example of a theoretically exploitable use-after-free by RCU (UAFBR) vulnerability.
However, the researcher announced that he intends to reveal the full technical details about StackRot and a proof-of-concept exploit by the end of July.
Linux kernel 6.1 has been approved as a long-term support (LTS) release since February, however not all major Linux distributions have adopted it.
For example, Ubuntu 22.04.2 LTS (Jammy Jellyfish), whose mainstream support ends in April 2027, ships with Linux kernel version 5.19. On the other hand, Debian 12 (Bookworm) ships with Linux kernel 6.1.
Users should check the kernel version of their Linux distribution and choose a version that is not affected by StackRot or an updated version that contains the fix.
Information source: bleepingcomputer.com
