Researchers have identified several Linux kernel vulnerabilities that allow unauthorized modification of system files by exploiting shared memory pages. These flaws, including Copy Fail, Dirty Frag, and pedit COW, bypass standard file permission checks by manipulating data directly within the page cache.
The vulnerabilities stem from improper handling of shared memory in kernel subsystems, such as cryptography and network packet processing. By using zero-copy mechanisms, the kernel may inadvertently grant these subsystems access to shared pages, which are then modified in-place. This allows an attacker to alter the contents of read-only files in memory.
Exploitation typically involves using user namespaces to gain limited privileges, which are then used to trigger the kernel flaws. For instance, an attacker can modify the instructions of a setuid program in the page cache, leading to privilege escalation when the program is executed. These methods do not change the file on disk but affect the cached version.
The primary defense against these vulnerabilities is updating the Linux kernel. Because the issues reside within the kernel's memory management, standard file permission settings are ineffective. Administrators should verify patches through vendor security bulletins rather than relying solely on kernel version numbers.
Additional mitigation strategies include restricting access to specific kernel subsystems like AF_ALG, XFRM/ESP, and tc/act_pedit if they are not required. However, disabling these components requires careful dependency analysis to avoid disrupting system services. Maintaining an accurate inventory of IT infrastructure is essential for tracking and managing these updates across large server fleets.
