New Exploitation Method Discovered for Linux Kernel Use-After-Free Vulnerability

A new exploitation method has been discovered for the Linux kernel use-after-free vulnerability tracked as CVE-2024-50264, a flaw described as a race condition in the AF_VSOCK subsystem present since Linux kernel 4.8. The article notes that the bug allows an unprivileged attacker to trigger a use-after-free scenario in the virtio_vsock_sock object during socket connection operations, without user namespace privileges.

Researchers have developed innovative techniques to bypass kernel slab allocator and race-condition protections, making exploitation more feasible than previously believed, with the breakthrough facilitated by kernel-hack-drill, an open-source testing environment for Linux kernel exploits.

The breakthrough exploitation techniques include interrupting the vulnerable connect() syscall with an immortal POSIX signal, cross-cache allocation to reclaim freed objects, and corrupting key kernel objects such as msg_msg and pipe_buffer for information leaks and arbitrary address read/write, enabling out-of-bounds kernel memory reads to extract sensitive pointers like credentials.

The method also adapts privilege-escalation tactics such as Dirty Pipe and Dirty Pagetable to more restrictive environments, and security teams are urged to treat CVE-2024-50264 as a major threat requiring urgent patching and review of kernel object hardening, according to GBHackers On Security.