What happened?
A security researcher going by the pseudonym _SiCK has published several proof-of-concept exploits on Github that take advantage of a vulnerability in the Linux kernel's memory and process management. The flaw allows local users without special privileges to read files under certain conditions that are normally accessible only to the root user. This is already the fourth security vulnerability within a few days that enables Linux users to escalate their privileges.
The PoC example with the most severe impact is called ssh-keysign-pwn. It reads out the machine's SSH private key—a file that under normal circumstances is accessible only to the root user. Another example uses the "chage" program to read the password file /etc/shadow while it is being executed.
The Details
The root cause of the vulnerability lies deep within the kernel: the function ptrace_may_access() fails in an overly permissive manner (a so-called "fail open") for processes that are currently in the process of terminating. If an attacker wins a race condition—that is, a race between multiple simultaneously running processes—they can gain access to files that the dying process had previously opened, despite lacking the necessary permissions. This potentially affects all files opened by programs running with root privileges (setuid root), such as /etc/shadow or /etc/ssh/ssh_host_key.
The bug was discovered by the security firm Qualys. Linux maintainer Linus Torvalds fixed it late Thursday afternoon. Shortly thereafter, grsecurity founder Brad Spengler drew attention to the bug in a brief analysis on the social network X, which in turn sparked _SiCK's ambition to develop his own exploits. An official CVE identifier has not yet been assigned to the vulnerability.
Notably, the bug had already been spotted several years ago by Google security expert Jann Horn. At the time, he had already proposed a fix—however, it was never implemented. Linux kernel 7.0.8 now contains exclusively the fix for the security vulnerability exploited by ssh-keysign-pwn. Kernel maintainer Greg Kroah-Hartman commented on the situation on the Fediverse with a self-deprecating remark about a "big button" on his desk for triggering new kernel releases.
Assessment
This vulnerability is relevant to the security technology industry for several reasons. Access control, video surveillance, and alarm system management systems often run on Linux-based servers or embedded devices. If local users—for example, via compromised service accounts or inadequately secured access points—can read root-protected files such as SSH keys or password files, this opens the door to further attacks on the entire infrastructure.
Particularly critical is the fact that the vulnerability is not new: it was already known years ago but was never fixed. This is a prime example of how important continuous patch management remains, even for systems that are supposedly stable and mature. Since the vulnerability is in principle conceivable for any executable file with root privileges (setuid root), the attack surface is potentially broad and not limited to the PoC examples published so far.
Practical Tips
- System administrators can, as an interim measure, mitigate all currently known instances of the vulnerability using the command "echo 3 > /proc/sys/kernel/yama/ptrace_scope".
- The official fix is already included in Linux kernel 7.0.8—affected systems should be updated promptly as soon as the respective distribution provides a corresponding kernel package.
- Until patched distribution packages become available, the aforementioned workaround should be prioritized, especially on servers holding sensitive credentials (SSH keys, password files) and on security-critical systems such as access control or video surveillance servers.
- As a general precaution, it is advisable to review which local user accounts have access to affected systems at all, in order to reduce the attack surface for race-condition exploits overall.
Outlook
Since both major and minor Linux distributions must now incorporate the fix into new kernel packages and roll them out, some delay is to be expected—based on past experience—before all production systems are secured. During this transition period, the workaround described via the Yama ptrace setting remains the most important immediate measure for administrators.
Given that this is already the fourth comparable security vulnerability within a few days, it can be assumed that security researchers and kernel developers will continue to intensively scrutinize the Linux kernel's memory and process management. For operators of security-critical infrastructure—ranging from alarm systems and video surveillance systems to access control solutions—the incident underscores the need to tighten patch management processes and to apply even seemingly minor kernel updates promptly.
