- New Linux pedit COW exploit allows attackers to gain system root access by exploiting a vulnerability in the Linux kernel.
- The exploit works by poisoning cached binaries, specifically targeting the setuid-root binary /bin/su to deliver a root shell to the attacker.
- RHEL and Debian are immediately vulnerable as they ship with unprivileged user namespaces open by default, allowing unprivileged users to exploit this vulnerability.
- The root cause of the exploit is a partial-COW page-cache corruption bug present across Linux kernel versions v5.18 through v7.1-rc6.
- The exploit leverages the COW corruption primitive to overwrite the page-cached ELF entry point of the binary, executing commands that grant root access.
- Ubuntu restricts unprivileged user namespace creation by default, which mitigates this exploit, although the underlying kernel remains vulnerable.
- Debian 11 and 12 are still listed as vulnerable, and Red Hat has identified RHEL 8, 9, and 10 as affected systems.
A newly disclosed Linux kernel vulnerability is allowing unprivileged local users to escalate their privileges to root on major Linux distributions, including RHEL and Debian. This exploit takes advantage of a Copy-on-Write (COW) page-cache corruption flaw found in kernel versions v5.18 through v7.1-rc6, which was patched in v7.1-rc7.3
The exploit works by poisoning the cached copy of the setuid-root binary /bin/su in memory, injecting a payload that executes setgid(0) and setuid(0), ultimately providing the attacker with a root shell. This method does not alter the file on disk, making it particularly stealthy.2
Both RHEL and Debian are vulnerable by default, as they ship with unprivileged user namespaces enabled. In contrast, Ubuntu has implemented restrictions through its AppArmor profiles, blocking unprivileged user namespace creation, although the underlying kernel remains susceptible. Debian versions 11 and 12 are still listed as vulnerable, while Red Hat has confirmed that RHEL 8, 9, and 10 are affected, but RHEL 7 is not.678
The CVE was assigned when the fix was merged on June 16, and a weaponized proof-of-concept was reported shortly thereafter, highlighting the urgency for users to apply patches to mitigate this risk.
“A newly disclosed Linux kernel vulnerability allows unprivileged local attackers to escalate privileges to root access. This exploit affects several major Linux distributions, including RHEL and Debian, which ship with unprivileged user namespaces enabled by default.”
CyberSecurityNews
