Manizada releases public exploits for decades-old Linux Kernel security flaws

Security researcher Asim Viladi Oglu Manizada¹ has just publicly released the exploit code² for 4 separate Linux Kernel³ local privilege escalation bugs that have been around for 10-21 years: DirtyAH6⁴, TUNderflow⁵, PPPoEject⁶, and DiagSpill⁷:

Per the coordinated embargo with linux-distros@, we agreed to publish the writeup/PoCs on September 18, 6am UTC, so the affected system owners can prioritize and apply the patches.

Two of the corruption bugs (DirtyAH6 and DiagSpill) can be exploited to remotely crash/DoS a machine. DirtyAH6 can theoretically be used to achieve remote root access.

Mitigation

* (recommended):
Upgrade to a kernel containing all four fixes:
5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4

* (alternative, until patching is possible):
Disable unprivileged user namespaces and relevant functionality -
AH6, TUN/TAP, PPPoE, and SCTP/sctp_diag

Run uname -r to display the current kernel version that is running on your system and check your distro’s security advisory to confirm that it has included an update that fixes all the bugs.

Consult Manizada’s post⁸ for more technical details and a list of affected upstream kernel versions.

Note that disabling unprivileged user namespaces doesn’t protect against DiagSpill; only disabling PoC-specific kmods could leave other paths to root open. Patching/updating is recommended.

This is an ongoing story and the report will be updated when new information is available.