PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-26809] OtterRoot: Netfilter universal root 1-day

osec.io | vulnerability | CVE-2024-26809 | #linux | #privilege-escalation | #kernel | #container-escape | #netfilter | #cve-2024-26809
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec's OtterRoot: how monitoring Linux kernel commits enabled exploiting a netfilter 1-day (CVE-2024-26809) within the patch gap for universal LPE/container escape and a KernelCTF win.
CVE
CVE-2024-26809
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
vulnerability · projectzero.google
Exploiting the Linux kernel via packet sockets
A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.
tool · github.com
Linux LPE Toolkit: Multi-Architecture Automated Privilege Escalation Tool
Provides penetration testers and red teams with an all-in-one, multi-architecture automated post-exploitation toolkit that simplifies Linux kernel privilege escalation without requiring on-target compilers.
research · starlabs.sg
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.
blog · projectzero.google
Taking a page from the kernel's book: A TLB issue in mremap()
This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.
Back