A Linux 6.1 kernel change translating VMA (Virtual Memory Area) from a "red-black tree" structure to a "maple tree" led to a vulnerability (CVE-2023-3269) that allows an unprivileged user to execute their code with kernel rights. This vulnerability, codenamed StackRot, manifests starting with the 6.1 kernel release and has been fixed in updates 6.4.1, 6.3.11, and 6.1.37.
The "maple tree" structure is a variant of a B-tree that supports range value indexing and is designed for efficient use of modern processor caches. Compared to the "red-black tree", using the "maple tree" results in improved performance. The vulnerability stems from an error in the stack extension handler—within the "maple tree" structure used to manage virtual memory areas in the kernel, replacing a node in the tree could occur without locking for writes, creating conditions for accessing memory after it has been freed (use-after-free).
Exploiting the vulnerability was complicated by the fact that nodes in the "maple tree" structure are freed in a delayed manner using callback calls with RCU (Read-Copy-Update) locks. Nevertheless, researchers managed to overcome the challenges and prepared a working exploit, which they plan to publish by the end of July, to give users time to update their systems. Exploitation is possible in almost all kernel configurations and requires only minimal privileges.
Forrás: opennet.ru
