An unprivileged local user can exploit these flaws by mounting a manipulated overlay file system, allowing them to set privileged extended attributes. This action bypasses standard kernel security mechanisms and enables the escalation of privileges to root. The vulnerabilities affect various Ubuntu releases, including 23.04, 22.10, 22.04 LTS, and 18.04 LTS, depending on the specific kernel version in use (notably 5.4.0, 5.19.0, and 6.2.0). Given the availability of weaponized PoC code on public platforms, the likelihood of exploitation by local attackers is high.

Impact

Successful exploitation of these vulnerabilities allows an attacker with low-privilege local access to gain full administrative (root) control over the host system. This facilitates arbitrary code execution, complete system compromise, data exfiltration, and persistent access. All Ubuntu environments running vulnerable kernel versions are at risk if local access to the system is possible.

Recommendation

• Prioritize patching the kernel on all affected Ubuntu systems. Consult official Canonical security bulletins for the specific kernel packages addressing these CVEs.
• Monitor for the execution of unauthorized shell scripts or binaries from temporary directories, which is the observed delivery mechanism for the published PoC.
• Restrict local access and enforce the principle of least privilege to minimize the potential for exploitation by unauthenticated or low-privilege users.