news
Six-Year-Old Linux Kernel Flaw Lets Unprivileged Users Read Root-Owned Files
A proof-of-concept is available as ssh-keysign-pwn, taking advantage of the __ptrace_may_access() function in the Linux kernel, skipping the dumpable check when task->mm == NULL. As such, do_exit() runs exit_mm() before exit_files() (no mm, fds still there) and pidfd_getfd(2) succeeds in that window when the caller’s uid matches the target’s.
The proof-of-concept includes two files, sshkeysign_pwn, which prints the contents of the /etc/ssh/ssh_host_{ecdsa,ed25519,rsa}_key file, and chage_pwn, which prints the contents of the shadow file in /etc. These have been tested and confirmed on various Linux distributions, including Arch Linux, Debian, Ubuntu, CentOS, and Raspberry Pi OS.
Update (by Roy)
Some more:
-
Russell Coker ☛ Russell Coker: Debian SE GNU/Linux and ssh-keysign-pwn
I just tested out the ssh-keysign-pwn exploit [1] on Debian kernel 6.12.74+deb13+1-amd64 which was released before these exploits.
When sshkeysign_pwn is run as user_t the following is logged in the audit log and it fails to exploit anything: [...]
-
GamingOnLinux ☛ Fragnesia and ssh-keysign-pwn are the latest Linux security problems | GamingOnLinux
We're seeing a wave of Linux security issues lately as it has become a bigger focus, and now we have Fragnesia and ssh-keysign-pwn revealed. After the issues of Dirty Frag and Copy Fail recently, you should ensure you're keeping your system up to date and regularly checking for security updates.
ZDNet/SJVN:
-
The 4th Linux kernel flaw this month can lead to stolen SSH host keys
The good news is there's already a patch. The bad news is that the fix isn't available for all Linux distributions yet. Here's what you can do in the meantime.
Also:
-
Linus Torvalds Patched Linux File Descriptor Theft Vulnerability
The Linux kernel contained a logic flaw that allowed unprivileged users to "steal" file descriptors for root-protected files, such as SSH private keys and the /etc/shadow file. By exploiting a brief timing window during a process's exit, after its memory is cleared but before its files are closed, an attacker can use the pidfd_getfd syscall to bypass security checks that normally protect sensitive SUID processes.