CISA just gave you 72 hours on the Linux kernel. The real ask is the forensic triage.
CISA added three Linux kernel bugs to its Known Exploited Vulnerabilities catalog this past Friday, each with confirmed evidence of in-the-wild exploitation, and under its Binding Operational Directive it gave federal civilian agencies seventy-two hours — until Sunday — to apply a fix or an accepted mitigation. The three are a useful spread: a race condition in the AF_ALG crypto-socket layer that has been sitting in the kernel for roughly fourteen years, an out-of-bounds write in the ebtables SNAT path that a local attacker can push into a privilege escalation, and a TLS receive-path logic flaw (kTLS) that can leak memory or take a box down. One is rated critical. The important bit isn't the CVE list, though — it's the label CISA stapled to all three: forensic triage. That's not “please patch your servers.” That's “assume the thing is already in the house, then go find the evidence.”
That distinction is the part most operators will skim past, and it's the one worth your time. Kernel-level local privilege escalation isn't the same threat as a web app RCE. The attacker doesn't need to reach you through the firewall; they need a foothold you've already handed them — a compromised service account, a container escape, a tenant on the same hypervisor, a job that runs untrusted code. Once they're in the neighborhood, a kernel bug is the bridge from “that process” to “the whole machine.” So patching the kernel closes the front door, but if the bug has been live for weeks and you're running shared or multi-tenant infrastructure, the compromise may have happened before you ever saw the advisory. Patching is necessary but not sufficient; you still have to go look for what already moved.
Practically, that means two things. Don't treat this as a “security update at the next maintenance window” item if you're anywhere near the blast radius — the fourteen-year-old AF_ALG bug is a reminder that old, quiet code paths are where the least-surprising exploits come from, and the federal deadline exists because the exploitation is happening now. And if you're the kind of shop that can't realistically hunt every box, at least note where you can't — the shared kernel, the long-lived containers, the staging box still running a 2019 distro. The good news for the rest of us: none of these are flagged as a ransomware vehicle yet, so you're not in a race against a wiper, just against the slow bleed of a foothold you forgot you gave away. Which is why the real question for anyone running multi-tenant Linux is where you draw the line: when a kernel CVE gets a “forensic triage” label, do you go forensics on every box, or do you triage by blast radius and accept that the shared-kernel stuff is “we'll find out later”? Patch it and move on, or rebuild from scratch — where do you put the line, and have you had to walk it yet?
Sources
- CISA alerts of active exploitation of three Linux kernel flaws — BleepingComputer
- CISA Flags Three Actively Exploited Linux Kernel Flaws, Orders Federal Patch by Sunday — TechTimes
- CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild — The Hacker News
- CISA: Adds Known Exploited Vulnerabilities to Catalog — CISA.gov
Comments
Post a Comment