Story thread · 2 reports / 1 sources

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

thehackernews.com · 4dShare

A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update.

First report: New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch — thehackernews.com, 6d