{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/ghost-bx1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Ghost-Bx1"],"_cs_cpes":["cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-114148"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[".NET","ASP.NET",".NET 8.x (\u003c 8.0.33)",".NET 9.x (\u003c 9.0.22)",".NET 10.x (\u003c 10.0.14)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","privilege-escalation","runtime","linux",".net","cve-2026-114148"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2026-114148 is a local privilege escalation vulnerability affecting .NET Linux source-build and ASP.NET Core tarballs. The vulnerability arises because archive metadata includes root-owned (uid=0/gid=0) attributes and SUID bits on critical executables. When extracted by an administrator with root privileges, the kernel preserves these attributes. An attacker capable of substituting the legitimate tarball in locations such as package caches, CI/CD pipelines, or via unvalidated network downloads can trick an administrator into executing the tampered binary to gain root access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains or creates a malicious version of a .NET tarball.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the tarball contents to include a malicious executable with SUID bits (mode 4755) and root ownership (uid=0, gid=0) metadata.\u003c/li\u003e\n\u003cli\u003eAttacker places the malicious tarball into a target environment via an insecure cache directory, compromised internal repository, or CI/CD pipeline.\u003c/li\u003e\n\u003cli\u003eAdministrator (or automated build process) executes the extraction command with root privileges (e.g., sudo tar -xzf).\u003c/li\u003e\n\u003cli\u003eThe extraction process preserves the SUID and root-owner attributes of the injected binary.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the tampered binary, which triggers a privilege escalation to root.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full root-level compromise of the affected Linux system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade .NET environments to the following patched versions immediately: 8.0.33, 9.0.22, or 10.0.14.\u003c/li\u003e\n\u003cli\u003eImplement mandatory checksum verification for all downloaded .NET source-build or ASP.NET Core tarballs.\u003c/li\u003e\n\u003cli\u003eModify extraction procedures for root-privileged users to include the \u003ccode\u003e--no-same-owner\u003c/code\u003e flag: \u003ccode\u003esudo tar --no-same-owner -xzf \u0026lt;archive.tar.gz\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSecure package cache directories and internal artifacts stores to prevent unauthorized modification.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T17:08:19Z","date_published":"2026-10-26T19:11:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-dotnet-privilege-escalation/","summary":"CVE-2026-114148 allows local privilege escalation on Linux when an administrator extracts a malicious .NET tarball containing root-owned SUID binaries.","title":"Microsoft .NET: Local Privilege Escalation via SUID tarball extraction (CVE-2026-114148)","url":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-dotnet-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Ghost-Bx1","version":"https://jsonfeed.org/version/1.1"}