Critical RCE Vulnerability Reported in Linux Kernel's TIPC Module

guest · Nov 4, 2021

Critical RCE Vulnerability Reported in Linux Kernel's TIPC Module
November 4, 2021
https://thehackernews.com/2021/11/critical-rce-vulnerability-reported-in.html

Cybersecurity researchers have disclosed a security flaw in the Linux Kernel's Transparent Inter Process Communication (TIPC) module that could potentially be leveraged both locally as well as remotely to execute arbitrary code within the kernel and take control of vulnerable machines.

The heap overflow vulnerability "can be exploited locally or remotely within a network to gain kernel privileges, and would allow an attacker to compromise the entire system," cybersecurity firm SentinelOne said in a report published today and shared with The Hacker News.
Click to expand...

There is no evidence that the flaw has been abused in real-world attacks to date, and following responsible disclosure on October 19, the issue has been addressed in Linux Kernel version 5.15 released on October 31, 2021.

"The function tipc_crypto_key_rcv is used to parse MSG_CRYPTO messages to receive keys from other nodes in the cluster in order to decrypt any further messages from them," Linux kernel maintainers sai\d in a fix pushed late last month. "This patch verifies that any supplied sizes in the message body are valid for the received message."
Click to expand...

"While TIPC itself isn't loaded automatically by the system but by end users, the ability to configure it from an unprivileged local perspective and the possibility of remote exploitation makes this a dangerous vulnerability for those that use it in their networks," SentinelOne researcher Max Van Amerongen said.
Click to expand...

SentinelLabs: CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution

Executive Summary

SentinelLabs has discovered a heap overflow vulnerability in the TIPC module of the Linux Kernel.

The vulnerability can be exploited either locally or remotely within a network to gain kernel privileges, allowing an attacker to compromise the entire system.

The TIPC module comes with all major Linux distributions but needs to be loaded in order to enable the protocol.

A patch has been released on the 29th of October and affects kernel versions between 5.10 and 5.15.

At this time, SentinelOne has not identified evidence of in-the-wild abuse.

Click to expand...

Log in or Sign up

Critical RCE Vulnerability Reported in Linux Kernel's TIPC Module

guest Guest

Log in or Sign up

Critical RCE Vulnerability Reported in Linux Kernel's TIPC Module

guest Guest

Useful Searches