Security researchers from Google discovered a vulnerability (CVE-2025-38236) in the Linux kernel that enables privilege escalation in the system. Among other things, the vulnerability allows bypassing the sandbox isolation mechanism used in Google Chrome, leading to the execution of code at the kernel level while running code in the context of an isolated Chrome rendering process (for example, when exploiting another vulnerability in Chrome). The issue appears from Linux kernel version 6.9 and has been fixed in updates for Linux kernels 6.1.143, 6.6.96, 6.12.36, and 6.15.5. An exploit prototype is available for download.
The vulnerability is caused by an error in the implementation of the MSG_OOB flag, which can be set for AF_UNIX sockets. The MSG_OOB ('out-of-band') flag allows attaching an additional byte to the sent data, which can be read by the receiver before receiving the rest of the data. This flag was introduced in the Linux kernel 5.15 at Oracle's request and was proposed last year for deprecation, as it had not gained widespread use.
In the implementation of Chrome's sandbox environment, operations with UNIX sockets and the send()/recv() system calls were permitted, allowing the MSG_OOB flag alongside other options without being filtered separately. The error in the MSG_OOB implementation allowed for memory access after it was freed (use-after-free) after executing a specific sequence of system calls: char dummy; int socks[2]; socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, MSG_OOB); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, MSG_OOB); send(socks[1], "A", 1, MSG_OOB); recv(socks[0], &dummy, 1, 0); recv(socks[0], &dummy, 1, MSG_OOB);
Source: opennet.ru
