Linux 3.13.0-32-generic Exploit Official

Posted by: Security Research Team Date: October 26, 2023 (Updated) Difficulty: Advanced Introduction If you have been in the cybersecurity space for a while, you have likely stumbled upon a vulnerability report or an exploit script mentioning a specific kernel string: linux 3.13.0-32-generic .

owen:$6$salt$hash:0:0:root:/root:/bin/bash After a successful exploit, the attacker runs su owen (no password needed depending on the crafted hash) and becomes root. Disclaimer: Only run this on systems you own or have explicit written permission to test. linux 3.13.0-32-generic exploit

For defenders, it serves as a stark reminder: If an attacker can tell you your exact kernel version and then drop to root in under 5 seconds, you have a problem. Posted by: Security Research Team Date: October 26,

char opts[256]; snprintf(opts, sizeof(opts), "lowerdir=%s,upperdir=%s,workdir=%s", lower, upper, work); mount("overlay", merged, "overlayfs", 0, opts); Now, inside /tmp/merged , the file file appears. If you edit it, the changes actually go to /tmp/upper/file . This is where the exploit deviates from normal behavior. The attacker creates a second thread. Thread A tries to rename the file from the overlay to a protected location (e.g., /etc/cron.d/exploit ). Thread B constantly churns the filesystem by creating and deleting files in the upper directory. For defenders, it serves as a stark reminder:

char *lower = "/tmp/lower"; char *upper = "/tmp/upper"; char *work = "/tmp/work"; char *merged = "/tmp/merged"; mkdir(lower, 0777); mkdir(upper, 0777); mkdir(work, 0777); mkdir(merged, 0777); Inside the lower directory, the exploit creates a dummy file that it will later try to replace.

The bug resided in the overlayfs implementation regarding the rename operation. Specifically, when renaming a file across directories on an overlayfs mount, the kernel failed to properly check permissions on the upper directory. A local attacker could exploit this race condition to rename a file from a world-writable location to a protected location (like /etc/passwd or /etc/sudoers ). In a normal filesystem, renaming a file requires write permissions on the source and target directories. However, in the buggy overlayfs code, the kernel performed the rename operation using the lower filesystem's credentials (which are privileged) instead of the calling user's credentials.