{"id":109268,"date":"2023-07-06T03:10:18","date_gmt":"2023-07-06T01:10:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=109268"},"modified":"2023-07-06T09:41:48","modified_gmt":"2023-07-06T07:41:48","slug":"uyazvimost-stackrot-v-yadre-linux-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-stackrot-v-yadre-linux-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"The StackRot vulnerability in the Linux kernel allows privilege escalation.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The completed transition in the Linux kernel 6.1 from the VMA (Virtual Memory Area) data structure using a 'red-black tree' to a 'maple tree' has resulted in a vulnerability (CVE-2023-3269) that allows an unprivileged user to execute code with kernel privileges. The vulnerability, codenamed StackRot, appears starting from the 6.1 kernel release and has been addressed in updates 6.4.1, 6.3.11, and 6.1.37. <\/p>\n
The 'maple tree' structure is a variant of the B-tree, supporting range-based indexing and designed for efficient cache utilization in modern processors. Compared to the 'red-black tree', the use of the 'maple tree' allows for higher performance. The vulnerability is caused by an error in the stack extension handler \u2014 in the 'maple tree' structure used for managing virtual memory areas in the kernel, replacing a node in the tree could occur without acquiring a write lock, creating a condition for accessing memory after it was freed (use-after-free). <\/p>\n
Exploiting the vulnerability was complicated by the fact that nodes in the 'maple tree' structure are freed in a deferred manner using RCU (Read-copy-update) callback calls. Nevertheless, researchers managed to overcome the challenges and prepare a working exploit, which they plan to publish at the end of July to give users time to update their systems. Exploitation is possible in almost all kernel configurations and requires only minimal privileges. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"