A Linux kernel has revealed a fifth critical vulnerability in the last two weeks that allows a user to escalate their privileges in the system. Two working exploits have been published: sshkeysign_pwn enables an unprivileged user to read the contents of the private host SSH keys /etc/ssh/ssh_host_*_key, while chage_pwn allows reading the contents of the /etc/shadow file with user password hashes.
The details of the vulnerability were not intended for disclosure, but one of the security researchers managed to identify the essence of the vulnerability based on the patch proposed for the kernel, allowing files accessible only to the root user, such as /etc/shadow, to be read. The change added to the kernel adjusted the logic of using the get_dumpable() function in ptrace when determining access level in the ptrace_may_access() function.
The vulnerability itself is caused by a race condition that leads to the possibility of unprivileged access to the pidfd file descriptor after accessing a file from a suid root process. At the moment between opening the file and dropping privileges in the suid program (for example, through the setreuid function), there arises a situation where the application that launched the suid root program can access the file opened in the suid program through the pidfd descriptor, even if file access rights do not permit this.
The exploitation window arises because the function '__ptrace_may_access()' skips checking for file access if the task->mm field is set to NULL after executing exit_mm() but before calling exit_files(). At this moment, the system call pidfd_getfd assumes that the user ID (uid) of the calling process corresponds to the ID allowed access to the file. Notably, the issue was also mentioned in 2020, but it remained unaddressed.
In the exploit that retrieves the content of /etc/shadow, the attack boils down to cyclically launching the /usr/bin/chage application with the suid root flag, reading the contents of /etc/shadow. After the process forks, the pidfd_open system call is executed and a cyclic enumeration of available pidfd descriptors is carried out through the pidfd_getfd system call and checked via /proc/self/fd. In the sshkeysign_pwn exploit, similar manipulations are performed with the suid root program ssh-keysign.
A CVE identifier for the problem has not yet been assigned, and updates for the kernel and packages in the distributions have not been published. The vulnerabilities are still present in kernels 7.0.7, 6.18.30, and 6.12.88 released a few hours ago. At the time of writing, only a patch can be used. Possible workarounds to block the vulnerability are being discussed, such as setting sysctl kernel.yama.ptrace_scope=3 or removing the suid root flag from executable files in the system (at least from the ssh-keysign and chage utilities used in exploits).
Additional information: The vulnerability has been assigned CVE-2026-46333. Updates for the Linux kernel 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256 have been released to address the vulnerability. The status of vulnerability mitigation in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Forrás: opennet.ru
