An exploit for the seventh vulnerability (1, 2-3, 4, 5, 6) in the Linux kernel has been made publicly available, allowing an unprivileged local user to gain root access by overwriting data in the page cache. A CVE identifier has yet to be assigned, and aside from the exploit code, no further information about the issue is currently available. A fix is only available as a patch, which was published on May 20 and accepted into the main Linux kernel branch on May 21 (corrective kernel releases are not yet available).
The vulnerability exists in the implementation of the GRO (Generic Receive Offload) technology, used to accelerate the processing of segmented packets. It arises from an error in the zerocopy mechanism implemented in the skb_gro_receive() function, which directly modifies data in the page cache to avoid unnecessary buffering. When the SKBFL_MANAGED_FRAG_REFS flag is set, the reference to the freed memory pages is omitted in the shinfo->frags field, which is then attached to another skb without changing the reference counter, leading to accessing memory after it has been freed (use-after-free). The issue was exploitable to overwrite data in the page cache through manipulation of the io_uring buffer pointer.
The attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0). For the exploit to work, a readable executable file with the SUID-root flag must be available in the system. The exploitation mechanism works by having the attacker cause the user database to reside in the page cache, after which a string "hax::0:0::/root:/bin/sh" is injected into the cache. Then, the command "su hax" is executed, which retrieves a modified copy of the user database with the substituted login "hax", granting it root permissions and a blank password. The exploit has been tested on Ubuntu 24.04.
Source: opennet.ru
