Security researchers from Google have discovered a vulnerability in the kernel Linux A privilege escalation vulnerability (CVE-2025-38236) exists. Among other things, the vulnerability allows for bypassing the sandbox isolation mechanism used in Google Chrome and achieving kernel-level code execution when executing code in the context of Chrome's sandboxed rendering process (for example, by exploiting another vulnerability in Chrome). The issue manifests itself starting in the kernel. Linux 6.9 and fixed in kernel updates Linux 6.1.143, 6.6.96, 6.12.36 and 6.15.5. An exploit prototype is available for download.
The vulnerability is caused by an implementation error in the MSG_OOB flag, which can be set for AF_UNIX sockets. The MSG_OOB ("out-of-band") flag allows an additional byte to be appended to the data being sent, which the recipient can read before receiving the rest of the data. This flag was added to the kernel. Linux 5.15 was requested by Oracle and was proposed for deprecation last year as it was not widely adopted.
Chrome's sandbox implementation allowed UNIX socket operations and send()/recv() system calls where the MSG_OOB flag was allowed along with other options and was not separately filtered. A bug in the MSG_OOB implementation allowed for a use-after-free condition to occur after executing a certain sequence of system calls: char dummy; int socks[2]; socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, MSG_OOB); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, MSG_OOB); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, 0); recv(socks[0], &dummy, 1, MSG_OOB);
Source: opennet.ru
