New SLUBStick Attack Makes Linux Kernel Vulnerabilities More Dangerous

A new exploitation technique for the Linux kernel, named SLUBStick, has been developed by researchers from Graz University of Technology. This technique enhances the danger posed by heap vulnerabilities, which have been on the rise in recent years. While previous methods, such as software cross-cache attacks, had limited success rates and often led to system crashes, SLUBStick boasts a success rate exceeding 99% on commonly used caches. It allows attackers to escalate limited heap vulnerabilities into arbitrary memory read/write capabilities, facilitating privilege escalation and container escapes, even against modern security defenses. The researchers demonstrated SLUBStick's effectiveness on Linux kernel versions 5.19 and 6.2, targeting nine known vulnerabilities from 2021 to 2023. They have made the SLUBStick artifacts and code available for public use, along with videos showcasing the exploit. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently warned about several Linux kernel vulnerabilities that are actively being exploited, with 14 flaws currently listed in their Known Exploited Vulnerabilities Catalog.

- SLUBStick is a new technique that increases the risk of Linux kernel heap vulnerabilities.

- It allows for a high success rate in exploiting memory vulnerabilities, surpassing previous methods.

- The technique can lead to privilege escalation and container escapes.

- Researchers have demonstrated SLUBStick against specific Linux kernel versions and vulnerabilities.

- CISA has issued warnings about actively exploited Linux kernel vulnerabilities.