{"id":109268,"date":"2023-07-06T03:10:18","date_gmt":"2023-07-06T01:10:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=109268"},"modified":"2023-07-06T09:41:48","modified_gmt":"2023-07-06T07:41:48","slug":"uyazvimost-stackrot-v-yadre-linux-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-stackrot-v-yadre-linux-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"StackRot sebezhet\u0151s\u00e9g a Linux kernelben, amely lehet\u0151v\u00e9 teszi a privil\u00e9giumok emel\u00e9s\u00e9t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Linux kernel 6.1 translation of VMA (Virtual Memory Area) from the data structure 'red-black tree' to 'maple tree' has resulted in a vulnerability (CVE-2023-3269) that allows an unprivileged user to execute their code with kernel privileges. The vulnerability, codenamed StackRot, has been present since the release of kernel 6.1 and has been addressed in updates 6.4.1, 6.3.11, and 6.1.37. <\/p>\n
The 'maple tree' structure is a variant of B-tree that supports indexing by range of values and is designed for efficient cache utilization in modern processors. Compared to 'red-black tree', using 'maple tree' achieves higher performance. The vulnerability is caused by an error in the stack extension handler \u2014 in the 'maple tree' structure used for managing virtual memory areas in the kernel, node replacement in the tree could occur without acquiring a write lock, creating conditions for accessing memory after it has been freed (use-after-free). <\/p>\n
Exploiting the vulnerability was complicated by the fact that nodes in the 'maple tree' structure are freed in a deferred manner using callback calls with RCU (Read-copy-update) locks. Nevertheless, researchers were able to overcome the difficulties and prepare a working exploit, which they plan to publish at the end of July to give users time to update their systems. Exploitation is possible in almost all kernel configurations and requires only minimal privileges. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"