Exploit released for new DirtyDecrypt Linux root flaw
▼ Summary
– A recently patched local privilege escalation vulnerability exists in the Linux kernel’s rxgk module.
– A proof-of-concept exploit for this vulnerability allows attackers to gain root access on some Linux systems.
A proof-of-concept exploit has been publicly released for a newly discovered local privilege escalation vulnerability in the Linux kernel’s rxgk module, a flaw that has been dubbed DirtyDecrypt. This security bug, which was recently patched, enables attackers to achieve full root access on certain Linux systems.
The vulnerability, tracked as CVE-2024-xxxxx, resides in the kernel’s handling of cryptographic operations within the rxgk component. By exploiting a race condition or memory corruption issue, a local attacker with limited privileges can escalate their permissions to root level, effectively taking complete control of the affected machine.
The DirtyDecrypt exploit targets systems running unpatched Linux kernels, specifically those that utilize the rxgk module for cryptographic operations. Researchers have demonstrated that the attack can be executed reliably on vulnerable configurations, making it a serious threat for organizations that have not applied the latest kernel updates.
Security experts strongly advise administrators to prioritize patching their Linux systems immediately. The Linux kernel maintainers have already released a fix as part of the latest stable kernel update, and major distributions like Ubuntu, Debian, and Red Hat have backported the patch to their supported versions.
Given the availability of a functional proof-of-concept, the risk of active exploitation in the wild is now elevated. Attackers who already have a foothold on a vulnerable system can use this exploit to escalate privileges and gain persistent, unrestricted access. Organizations should also review their kernel update policies and ensure that all systems are running the latest patched version to mitigate this threat.
(Source: BleepingComputer)
