{"id":115019,"date":"2024-04-12T20:30:02","date_gmt":"2024-04-12T18:30:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/0-day-uyazvimost-v-drajvere-n_gsm-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2024-04-12T20:30:02","modified_gmt":"2024-04-12T18:30:02","slug":"0-day-uyazvimost-v-drajvere-n_gsm-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/0-day-uyazvimost-v-drajvere-n_gsm-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"0-day vulnerability in the n_gsm driver allowing code execution at the Linux kernel level","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two exploits have been discovered publicly that involve a previously unknown vulnerability in the n_gsm driver, which is part of the Linux kernel. This vulnerability allows an unprivileged local user to execute code at the kernel level and elevate their privileges in the system. No CVE identifier has been assigned. The issue remains unpatched. <\/p>\n
The n_gsm driver provides an implementation of the GSM 07.10 protocol, used in GSM modems for multiplexing connections to the serial port. The vulnerability is caused by a race condition in the GSMIOC_SETCONF_DLCI ioctl handler used for updating the DLCI (Data Link Connection Identifier) configuration. Manipulating the ioctl can lead to a use-after-free memory access. <\/p>\n
The exploit can be used on systems with Linux kernels ranging from 5.15 to 6.5. For instance, successful root access has been demonstrated on Fedora, Ubuntu 22.04 with kernel 6.5, and on Debian 12 with kernel 6.1. Starting from kernel 6.6, CAP_NET_ADMIN access rights are required for exploitation. As a workaround to mitigate the vulnerability, automatic loading of the n_gsm kernel module can be prevented by adding the line \"blacklist n_gsm\" to the file \/etc\/modprobe.d\/blacklist.conf. <\/p>\n
Notably, in January information was disclosed about another vulnerability (CVE-2023-6546) in the n_gsm driver, for which a public exploit is also available. This vulnerability does not overlap with the first issue, although it is also caused by a use-after-free memory access when working with the gsm_dlci structure, but in the GSMIOC_SETCONF ioctl handler. The issue has been fixed in August of last year (the fix was included in kernel 6.5). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"