18-Year-Old Linux Kernel Bug Allows Full System Takeover

Researchers at Tencent Zhuque Lab uncovered an 18-year-old vulnerability in the Linux kernel that can escape containers and gain full root privileges on the host system.

Memory safety issues continue to plague operating systems like Linux written in unsafe languages like C++. Google's data shows that memory safety issues used to make up around 76% of vulnerabilities on Android before they started switching to memory-safe languages for new code.

They also stated in the same post that most memory safety vulnerabilities tend to show up in newer code, so focusing on switching new code to memory-safe languages in new code is good enough to make a big security difference.

Now with AI-assisted security research, many severe, over decade-old vulnerabilities that have alluded human researchers for years are being found, putting into question how safe older code really is.

The vulnerability, dubbed SCTPhantom, is a user-after-free vulnerability in the SCTP protocol's Dynamic Access Reconfiguration feature in the Linux kernel.

The code introducing the bug dates all the way back to 2007 in Linux 2.6.25, making the bug 18 years old.

The root cause of the vulnerability lies in ASCONF, which contains operations such as ADD-IP, DEL-IP, and SET-PRIMARY, which are processed in order on Linux.

The vulnerable ASCONF chunk uses two different identities: the IPv4 packet source Sand the Address Parameter L used to select a transport. The DEL-IP check validates the requested address against S, while later processing relies on the transport selected through L.

Because S and L are different, DEL-IP L passes the source-address check and removes transport(L). The wildcard DEL-IP then reuses the cached pointer to that transport as the path to preserve. As a result, the association can retain the removed transport in primary_path and active_path, allowing a later socket operation to dereference a stale pointer.

The researchers made use of an AI called Corvus during the process of developing the exploit, which they say was a significant help in their research workflow.

Linux has already begun removing old cruft from the kernel in response to the influx of AI bug reports, but even with those efforts, the kernel is so massive that there's bound to be countless bugs still.

Greater efforts toward removing attack surface in the kernel and a push for memory-safe languages like Rust would significantly improve its resilience against the current onslaught of bugs.