Ghost-Bx1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/ghost-bx1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 19:11:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft .NET: Local Privilege Escalation via SUID tarball extraction (CVE-2026-114148)https://feed.craftedsignal.io/briefs/2026-10-microsoft-dotnet-privilege-escalation/Mon, 26 Oct 2026 19:11:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-microsoft-dotnet-privilege-escalation/CVE-2026-114148 allows local privilege escalation on Linux when an administrator extracts a malicious .NET tarball containing root-owned SUID binaries.CVE-2026-114148 is a local privilege escalation vulnerability affecting .NET Linux source-build and ASP.NET Core tarballs. The vulnerability arises because archive metadata includes root-owned (uid=0/gid=0) attributes and SUID bits on critical executables. When extracted by an administrator with root privileges, the kernel preserves these attributes. An attacker capable of substituting the legitimate tarball in locations such as package caches, CI/CD pipelines, or via unvalidated network downloads can trick an administrator into executing the tampered binary to gain root access.

Attack Chain

  1. Attacker obtains or creates a malicious version of a .NET tarball.
  2. Attacker modifies the tarball contents to include a malicious executable with SUID bits (mode 4755) and root ownership (uid=0, gid=0) metadata.
  3. Attacker places the malicious tarball into a target environment via an insecure cache directory, compromised internal repository, or CI/CD pipeline.
  4. Administrator (or automated build process) executes the extraction command with root privileges (e.g., sudo tar -xzf).
  5. The extraction process preserves the SUID and root-owner attributes of the injected binary.
  6. The attacker executes the tampered binary, which triggers a privilege escalation to root.

Impact

Successful exploitation results in full root-level compromise of the affected Linux system.

Recommendation

  • Upgrade .NET environments to the following patched versions immediately: 8.0.33, 9.0.22, or 10.0.14.
  • Implement mandatory checksum verification for all downloaded .NET source-build or ASP.NET Core tarballs.
  • Modify extraction procedures for root-privileged users to include the --no-same-owner flag: sudo tar --no-same-owner -xzf <archive.tar.gz>.
  • Secure package cache directories and internal artifacts stores to prevent unauthorized modification.
]]>highthreatvulnerabilityprivilege-escalationruntimelinux.netcve-2026-114148