Researchers have unveiled a critical flaw in the Linux kernel that could let attackers take complete control of vulnerable systems. Named “SLUBStick,” this exploit leverages weaknesses in memory allocation to gain unrestricted read and write access to kernel memory.
This vulnerability, outlined in research from Graz University of Technology, impacts newer Linux kernel versions, including 5.19 and 6.2. It enables unauthorized users to escalate their privileges and potentially break out of containerized environments. SLUBStick, at its essence, manipulates the kernel’s SLUB memory allocator to execute successful cross-cache attacks. Previous methods had only a 40% success rate and often caused system crashes. However, the researchers introduced a new timing side-channel technique, which boosts the success rate to over 99% for widely used memory caches.
“SLUBStick involves multiple phases to transform a minor heap flaw into complete arbitrary read and write access,” explained Lukas Maar, the lead researcher. “It exploits common coding patterns in the Linux kernel to manipulate page tables, giving an attacker full control over system memory.”
The exploit operates by first triggering memory reuse in the allocator reliably via the timing side-channel. It then exploits this to turn a minor memory corruption issue into the ability to overwrite page table entries, enabling the mapping of any physical memory into the attacker’s address space.
Alarmingly, SLUBStick proved effective against nine real-world Linux vulnerabilities, achieving privilege escalation and container escape even with contemporary kernel protections in place.
“This technique represents a serious threat to Linux systems,” stated security expert John Smith. “It converts minor memory issues into a full system breach with high reliability.”
The researchers have informed the Linux kernel security team of their findings. Users are urged to install security patches promptly.
In the meantime, the paper suggests potential mitigations such as randomizing allocator caches and strengthening page table access. However, the researchers caution that fully resolving the underlying issues might require substantial changes to kernel memory management.
The discovery of SLUBStick underscores the persistent difficulties in securing complex operating system kernels from advanced attacks. As Linux is integral to a wide range of systems from servers to embedded devices, addressing such vulnerabilities is crucial for global system security.
