Ubuntu Linux has been exposed to a critical vulnerability that affects systems running the 6.8.0-60-generic kernel version of Ubuntu 24.04.2. Local attackers can exploit this vulnerability to escalate privileges and ultimately gain root access on the affected systems. This vulnerability arises from an imbalance in reference counting within the af_unix subsystem, leading to a use-after-free (UAF) vulnerability. This critical vulnerability in Ubuntu highlights the ongoing challenges faced by mainstream Linux distributions in kernel patch management.
Vulnerability Overview
• Vulnerability Name: Ubuntu AF_UNIX Module Privilege Escalation Vulnerability.
• Vulnerability ID: LDYVUL-2025-00137002.
• Vulnerability Type: Use-After-Free (UAF) vulnerability.
• Affected Scope: Systems running the 6.8.0-60-generic kernel version of Ubuntu 24.04.2.
• Risk Level: Critical, with a CVSS 3.1 score of 7.1. Attackers can exploit this vulnerability to escalate privileges and ultimately gain Root access to the system.
Cause of the Vulnerability
• af_unix Subsystem Functionality: The af_unix subsystem is a critical module in the Linux kernel responsible for handling local inter-process communication (IPC) through Unix domain sockets, enabling efficient data transfer between processes and supporting core functionalities such as file descriptor passing. This subsystem manages socket buffer (sk_buff) resources using a reference counting mechanism and addresses circular reference issues through garbage collection (unix_gc).
• Upstream Patch Changes: The upstream Linux kernel has adjusted the management of out-of-band (OOB) socket buffer kernel (skb) references to fix the reference counting error in af_unix domain sockets. Specifically, the patch removed the skb_get() call within the queue_oob function in the af_unix.c file to avoid unnecessary reference count increments on u->oob_skb and correspondingly prevent decrementing its count during garbage collection.
• Ubuntu Kernel Patch Adaptation Flaw: The kernel of Ubuntu 24.04 is based on an older 6.8.12 version, retaining the traditional garbage collection mechanism but incorrectly applied modifications only to the af_unix.c file, missing updates to the garbage.c file. This mismatch caused the oob_skb to lose a reference count upon allocation but experience two decrements upon socket closure: once through unix_gc with kfree_skb and once through unix_release_sock, ultimately triggering a UAF vulnerability in the skbuff_head_cache slab for 256 byte struct sk_buff objects.
Impact of the Vulnerability
• Privilege Escalation: Local attackers can exploit this vulnerability to escalate privileges and ultimately gain Root access to the system, thereby gaining full control over the affected system.
• Data Leakage and Tampering: Once attackers gain Root access, they can steal sensitive data from the system, implant backdoor programs, tamper with system configurations, etc., posing serious threats to system and data security.
• Lateral Penetration: Attackers can use the acquired Root access to perform lateral penetration within the corporate intranet, expanding the attack surface and further threatening corporate network security.
Remediation Recommendations
• Update Kernel: The official Ubuntu has released a kernel update to fix this vulnerability. Users should promptly update the affected kernel packages to remediate the vulnerability. The kernel can be updated using the following command:
Protective Measures
• Limit Local User Permissions: Strictly limit local user permissions to prevent attackers from easily obtaining ordinary user privileges, thereby reducing the risk of the vulnerability being exploited.
• Enable Kernel Protection Mechanisms: Ensure that the system has enabled kernel address randomization (KASLR) and other protective mechanisms to increase the difficulty for attackers to exploit the vulnerability.
• Monitoring and Auditing: Deploy monitoring and auditing tools to monitor system behavior in real-time, promptly detect abnormal activities, and conduct audits and analyses to ensure timely detection and response when the vulnerability is exploited.