Researchers show 2008 bug can be leveraged to break out of container and reach host
A long‑standing use‑after‑free bug in Linux’s SCTP networking stack can be abused to acquire full root privileges and break out of containers. The vulnerability, which has existed since 2008, was demonstrated by researchers and fixed in kernel releases on August 3.
A use‑after‑free bug in Linux’s SCTP networking code can be turned into full root on a host.
Researchers from Tencent demonstrated that the flaw can be leveraged to escape a container and reach the underlying machine.
The flaw has been present in the kernel since 2008, long before the first public disclosure of the issue.
In a public statement, the researchers outlined how a local attacker can trigger the bug by sending a crafted SCTP packet that causes a memory corruption in the kernel’s SCTP subsystem.
Once the memory corruption is achieved, the attacker can execute arbitrary code with kernel privileges, allowing them to elevate privileges to root and then break out of a container boundary.
The vulnerability was assigned the identifier CVE‑2024‑xxx.
The Linux kernel team has already shipped a patch in the following stable releases: 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
The patch removes the vulnerable code path and adds bounds checking to the affected data structures.
System administrators should verify that their kernels are at least 7.1.6 or an equivalent patched release before attempting to use SCTP services.
If SCTP is not required, disabling the protocol entirely is also a viable mitigation strategy.
The researchers noted that the flaw can be triggered only by local users who have network access to the SCTP port, so a network‑level firewall can reduce the attack surface.
Users of older kernels should update immediately, as the vulnerability allows local privilege escalation and container escape.
The incident underscores the importance of addressing legacy code paths that have remained in the kernel for years.
The Linux kernel community has reiterated its commitment to patching such long‑standing bugs promptly once they are discovered.
No reports of exploitation in the wild have been documented as of yet.
A use‑after‑free bug in Linux’s SCTP networking code can be turned into full root on a host.
Researchers from Tencent demonstrated that the flaw can be leveraged to escape a container and reach the underlying machine.
The flaw has been present in the kernel since 2008, long before the first public disclosure of the issue.
In a public statement, the researchers outlined how a local attacker can trigger the bug by sending a crafted SCTP packet that causes a memory corruption in the kernel’s SCTP subsystem.
Once the memory corruption is achieved, the attacker can execute arbitrary code with kernel privileges, allowing them to elevate privileges to root and then break out of a container boundary.
The vulnerability was assigned the identifier CVE‑2024‑xxx.
The Linux kernel team has already shipped a patch in the following stable releases: 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
The patch removes the vulnerable code path and adds bounds checking to the affected data structures.
System administrators should verify that their kernels are at least 7.1.6 or an equivalent patched release before attempting to use SCTP services.
If SCTP is not required, disabling the protocol entirely is also a viable mitigation strategy.
The researchers noted that the flaw can be triggered only by local users who have network access to the SCTP port, so a network‑level firewall can reduce the attack surface.
Users of older kernels should update immediately, as the vulnerability allows local privilege escalation and container escape.
The incident underscores the importance of addressing legacy code paths that have remained in the kernel for years.
The Linux kernel community has reiterated its commitment to patching such long‑standing bugs promptly once they are discovered.
No reports of exploitation in the wild have been documented as of yet.