{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel--6.6.5-6.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.7:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2024-0582"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.6.5, 6.7)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","kernel","io_uring"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA proof-of-concept exploit for CVE-2024-0582 has been published, targeting a use-after-free vulnerability within the Linux kernel io_uring subsystem during buffer ring unregistration. The exploit utilizes a \u0026quot;Dirty Cred\u0026quot; approach to corrupt kernel structures, specifically modifying the f_mode flags of file descriptors to grant write access to protected files, including /etc/passwd. Successful exploitation allows a local attacker to escalate privileges to root by injecting a backdoor entry into /etc/passwd.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eSet CPU affinity and raise file descriptor limits to ensure exploit stability.\u003c/li\u003e\n\u003cli\u003eInitialize an io_uring instance and register a buffer ring in kernel memory.\u003c/li\u003e\n\u003cli\u003eUnregister the buffer ring to trigger the use-after-free vulnerability.\u003c/li\u003e\n\u003cli\u003ePerform a file descriptor spray to target the /etc/passwd file descriptor.\u003c/li\u003e\n\u003cli\u003eCorrupt the f_mode flags of the target file descriptor to make /etc/passwd writable.\u003c/li\u003e\n\u003cli\u003eAppend a custom root user backdoor entry to /etc/passwd.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants a local user full root privileges. The exploit requires local access and can be used to bypass system integrity by modifying sensitive configuration files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit kernel versions across the environment to identify systems running Linux Kernel versions \u0026lt; 6.6.5 or 6.7.\u003c/li\u003e\n\u003cli\u003ePrioritize patching affected Linux kernels to the latest available stable release.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring for unauthorized or anomalous modifications to /etc/passwd.\u003c/li\u003e\n\u003cli\u003eRestrict the use of io_uring for non-privileged users if the workload allows, as it is a common vector for local privilege escalation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T19:48:50Z","date_published":"2026-10-23T19:48:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/","summary":"CVE-2024-0582 is a privilege escalation vulnerability in the Linux kernel io_uring subsystem that enables unauthorized write access to /etc/passwd via a Dirty Cred technique.","title":"Linux Kernel: io_uring privilege escalation (CVE-2024-0582)","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (\u003c 6.6.5, 6.7)","version":"https://jsonfeed.org/version/1.1"}