[PLUG] Full Kernel-Level Control from Chrome Sandbox

[jeffv via plug <plug@lists.phillylinux.org>]

Critical Linux Kernel Bug Grants Attackers Full Kernel-Level Control 
from Chrome Sandbox

https://linuxsecurity.com/news/security-vulnerabilities/linux-kernel-bug-grants-attackers-full-kernel-level-control

Here’s where things go sideways. Horn’s write-up breaks it down, but the 
takeaway is this: there's a use-after-free (UAF) condition. 
Specifically, when the kernel processes out-of-band messages, it uses a 
data structure (oob_skb) to hold a reference to the socket buffer 
storing said message. The problem occurs when you start manipulating 
these buffers. Carefully crafted sequences of send() and recv() calls, 
which are normally valid, can force the kernel to reuse memory that was 
never properly cleaned up.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug