Two exploits have been discovered publicly that involve a previously unknown vulnerability in the n_gsm driver, which is part of the Linux kernel. This vulnerability allows an unprivileged local user to execute code at the kernel level and elevate their privileges in the system. No CVE identifier has been assigned. The issue remains unpatched.
The n_gsm driver provides an implementation of the GSM 07.10 protocol, used in GSM modems for multiplexing connections to the serial port. The vulnerability is caused by a race condition in the GSMIOC_SETCONF_DLCI ioctl handler used for updating the DLCI (Data Link Connection Identifier) configuration. Manipulating the ioctl can lead to a use-after-free memory access.
The exploit can be used on systems with Linux kernels ranging from 5.15 to 6.5. For example, successful root access has been demonstrated on Fedora, Ubuntu 22.04 with kernel 6.5, and Debian 12 with kernel 6.1. Starting with kernel 6.6, CAP_NET_ADMIN access rights are required for exploitation. As a workaround to block the vulnerability, the automatic loading of the n_gsm kernel module can be disabled by adding the line 'blacklist n_gsm' to the /etc/modprobe.d/blacklist.conf file.
Notably, in January information was disclosed about another vulnerability (CVE-2023-6546) in the n_gsm driver, for which a public exploit is also available. This vulnerability does not overlap with the first issue, although it is also caused by a use-after-free memory access when working with the gsm_dlci structure, but in the GSMIOC_SETCONF ioctl handler. The issue has been fixed in August of last year (the fix was included in kernel 6.5).
Source: opennet.ru
