Public Exploits Now Available for Four Linux Kernel Root Flaws

A security researcher has published working exploit code for four Linux kernel vulnerabilities, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, that each allow a local user to escalate to root, the highest level of system access. Kernel maintainers fixed all four flaws in recent weeks, so systems running an up-to-date kernel are not at risk. However, since the exploit code is now public, any machine still running an older kernel should be patched as soon as possible.

The researcher, Asim Manizada, reported the flaws to the Linux kernel security team in mid-July and published his findings on September 18 after coordinating with distributions to allow fixes to roll out first. Three of the four flaws require unprivileged user namespaces to be enabled, a common default setting on many Linux distributions that lets ordinary users operate as root within a sandboxed environment. The fourth, DiagSpill, needs no special privileges at all if the SCTP networking module is present. Two of the flaws, DirtyAH6 and DiagSpill, can potentially be triggered remotely, but only under narrow conditions, mainly causing a crash rather than full compromise.

There are no known reports of these flaws being exploited in real-world attacks, and the exploits are tailored to specific kernel builds. Still, public exploit code increases risk on shared or multi-user systems where an attacker may already hold limited access and seek to escalate privileges.