Před dvěma týdny objevila bezpečnostní skupina V12 zranitelnost PinTheft. Jde o zranitelnost v RDS (Reliable Datagram Sockets), která byla v jádře opravena začátkem května. Skupina také vydala PoC, umožňující lokálnímu útočníkovi získat práva roota. Útok však vyžaduje kromě modulu jádra RDS ještě io_uring API a další věci. Ze známých distribucí má ve výchozím stavu modul RDS pouze Arch Linux. Kdo by však chtěl mít jistotu, může zablokovat moduly jádra rds a  rds_tcp. (zdroj: bleepingcomputer)

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

A new proof-of-concept exploit for the patched Linux privilege escalation flaw PinTheft can let local attackers gain root on Arch Linux systems under specific conditions. The issue affects the RDS kernel module and comes amid other recently disclosed Linux LPE bugs, including DirtyDecrypt, DirtyCBC, Copy Fail, and Pack2TheRoot. #PinTheft #ArchLinux #RDS #DirtyDecrypt #DirtyCBC #CopyFail #Pack2TheRoot

Posted by Marcus Meissner on May 21 Hi, CVE-2026-43494 was assigned by the Kernel CNA to the fix in commit e174929793195e0cd6a4adb0cad731b39f9019b4. Ciao, Marcus

PinTheft is a Linux LPE flaw in the RDS subsystem with public exploit code. Arch Linux users should patch it immediately

A proof-of-concept (PoC) exploit was published for a new Linux Local Privilege Escalation (LPE) vulnerability dubbed “PinTheft.” Discovered by Aaron Esau of the V12 security team, the flaw allows local attackers to gain root access by exploiting an RDS zerocopy double-free bug. A kernel patch is currently available, prompting the researchers to release their PoC code to the public. PinTheft joins a growing list of recently disclosed Linux kernel vulnerabilities, underscoring the ongoing security challenges within complex kernel networking and asynchronous I/O subsystems. The vulnerability resides within the Reliable Datagram Sockets (RDS) zerocopy send path. Specifically, the function rds_message_zcopy_from_user() pins user pages one at a time during execution. If a subsequent page faults, the error path drops the pages it already pinned. A critical flaw emerges during later RDS message cleanup, which drops these pages a second time because the scatterlist entries and entry count remain active after the zcopy notifier clears. This double-free condition allows each failed zerocopy send to steal exactly one reference from the first page. To weaponize this reference count bug, the PinTheft exploit leverages io_uring . The attacker registers an anonymous page as a fixed buffer, assigning the page a FOLL_PIN bias of 1024 references. The exploit then systematically steals these references through failing RDS zerocopy sends until io_uring is left holding a stolen page pointer. This unique methodology of stealing FOLL_PIN references is what gives the exploit its name. PinTheft Linux Vulnerability Exploit The PoC repository provides a highly structured exploitation sequence to achieve root access while attempting to prevent permanent system corruption. The attack execution follows a precise chain of events: Target selection locates a readable SUID-root binary, prioritizing executables like /usr/bin/su , /usr/bin/mount , or /usr/bin/passwd . A safety backup of the on-disk binary is created before exploitation to allow for manual restoration. Page setup maps two pages and marks the second with PROT_NONE so a two-page RDS zcopy send will predictably fault. Fixed-buffer registration pins the target page using IORING_REGISTER_BUFFERS , adding 1024 references. A daemon child holds a cloned fixed buffer open, preventing io_buffer_unmap() from corrupting reclaimed pages later. Reference theft occurs as the exploit executes 1024 failing RDS zerocopy sends, double-dropping the first page during error cleanup. Page-cache reclaim evicts the SUID binary’s first page, reallocating it immediately so the stale io_uring fixed-buffer entry points to a live page cache. A dangling fixed-buffer write uses IORING_OP_READ_FIXED to overwrite the cache with a small malicious ELF payload, granting a root shell upon execution. While the exploitation primitive is architecture-independent, the embedded shell ELF provided in the PoC is specifically compiled for x86_64 environments. The vulnerability requires a specific kernel configuration to trigger successfully. PinTheft Linux Vulnerability (Source: V12 research team ) CONFIG_RDS and CONFIG_RDS_TCP must be enabled. CONFIG_IO_URING must be active with io_uring_disabled=0 . The system must allow module autoloading to request TCP transport. Default exposure is somewhat limited across major distributions. According to the V12 research team, the required RDS kernel module is only enabled by default on Arch Linux among the common distributions tested. Furthermore, researchers warn that running the exploit alters the in-memory page cache of critical SUID binaries. Rebooting or dropping caches will clear the memory overwrite, but testers on disposable machines must be careful not to leave systems in a state where common programs execute the payload unexpectedly. Administrators are strongly advised to apply the latest kernel patches from their distribution maintainers. For systems where patching is immediately unfeasible or RDS is unnecessary, administrators can mitigate the threat by entirely blacklisting the vulnerable modules. Executing the following command prevents the RDS modules from loading upon boot: printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf Administrators should also immediately remove active modules from running systems using rmmod rds_tcp rds . The release of the PinTheft PoC coincides with a surge in Linux kernel exploit disclosures. Recently, security researchers released PoC exploits targeting other patched Linux LPEs, tracked as DirtyDecrypt and DirtyCBC. These vulnerabilities share conceptual similarities with previous high-profile root-escalation flaws such as Dirty Frag , Fragnesia , and Copy Fail , highlighting an ongoing trend of attackers and researchers discovering complex memory-corruption primitives in core Linux systems. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post PinTheft Linux Vulnerability Let Attackers Gain Root Access – PoC Released appeared first on Cyber Security News .

PinTheft, a recently patched Linux privilege escalation vulnerability, now has a publicly available proof-of-concept (PoC) exploit that allows local attackers to gain root privileges on Arch Linux systems.

Posted by Jelle van der Waa on May 19 Fedora seems "unaffected", CONFIG_RDS=m is set in Fedora unlike RHEL and the kernel module is packaged in kernel-modules-extra which my Fedora Cloud Edition does not have pre-installed. [1] [2] After installing kernel-modules-extra, the modprobe config file still prevents it from being loaded: [root@fedora-44-127-0-0-2-2201 ~]# rpm -ql kernel-modules-extra | grep rds /etc/modprobe.d/rds-blacklist.conf...

Posted by Sam James on May 19 Sam James <sam () gentoo org> writes: Debian has this to prevent autoloading: https://salsa.debian.org/kernel-team/linux/-/blob/debian/6.12/trixie-security/debian/patches/debian/rds-Disable-auto-loading-as-mitigation-against-local.patch Ubuntu installs a few blacklist files from their kmod package (*): ``` /tmp/kmod/debian/modprobe.d $ cat blacklist-rare-network.conf # Many less commonly used network protocols have recently had various #...

Posted by Sam James on May 19 Sam James <sam () gentoo org> writes: While of course I can't know what distros they tested, this does seem to be on in at least Fedora too? https://oracle.github.io/kconfigs/ seems to agree with that. sam

Posted by Sam James on May 19 v12-security have shared a new Linux LPE today, PinTheft [0]. Quoting their abstract: The referenced kernel module is CONFIG_RDS + CONFIG_RDS_TCP. I attached their PoC too. [0] https://github.com/v12-security/pocs/tree/09e835b587bf71249775654061ae4c79e92cf430/pintheft thanks, sam /* * RDS zcopy double-free -> LPE via io_uring page cache overwrite * * Bug: rds_message_zcopy_from_user() pins user pages via GUP (FOLL_GET) one * at a...

Un code d'exploitation a été publié pour PinTheft, une faille dans le noyau Linux permettant d'effectuer une élévation de privilèges en local. Qui est affecté ?

PinTheft, a recently patched Linux privilege escalation vulnerability, now has a publicly available proof-of-concept (PoC) exploit that allows local attackers to gain root privileges on Arch Linux sys...

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

Si usas Arch Linux, esto te interesa. Ha aparecido una nueva vulnerabilidad en el kernel de Linux que ya tiene un exploit funcional publicado, lo que significa que no es solo teoría: cualquier persona...