.webp)
A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel which is identified as CVE-2023-40283 with a CVSS 3.1 score of 7.8 HIGH. The issue was discovered in l2cap_sock_release in /net/Bluetooth/l2cap_sock.c in versions of the linux kernel before 6.4.10. This is one of several recent vulnerabilities associated with the Linux kernel which all allow for a Secure Boot Bypass. The collection of vulnerabilities dubbed LogoFAIL leverages the UEFI BIOs capabilities of displaying images during boot to achieve arbitrary code execution and compromise the security of the entire system.
Use-After-Free (UAF) is a memory vulnerability that occurs when a program continues to access memory that has already been freed. This can happen when a program does not clear the pointer to a memory location after freeing it. This vulnerability impacts several Linux distributions such as Debian and Ubuntu. It was quoted affecting all versions of the Linux Kernel up to 6.4.10.
This also impacts a number of NetApp products.
This vulnerability was part of a chain of vulnerabilities used to compromise secure boot on a system. If exploited an advanced persistent threat can be installed on the device and will be near impossible to remove.
Review your organization’s software inventory for any installations of Linux. If any installations of it are found, determine whether an update is feasible for your organization.
Update the Linux distributions Ubuntu and Debian to a Linux Kernel version at or above 6.4.10
NetApp has ended the availability of the NetApp HCI Baseboard Management Controllers mentioned above, so no updates to or patches for these controllers will be made available.
An attacker leveraging this vulnerability could, at the very least, perform arbitrary code execution on the system. However, using it in conjunction with other vulnerabilities could allow for a secure boot UEFI bypass allowing the execution of code before the OS. This would cause the device to potentially be permanently hacked due to the possibility of an advanced persistent threat being installed on the machine. This could cause data exfiltration and complete takeover of the machine. Monetary and data loss are the main losses expected from this type of attack.
https://github.com/torvalds/linux/commit/1728137b33c00d5a2b5110ed7aafb42e7c32e4a1
https://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
