A newly disclosed Linux kernel vulnerability called SCTPhantom has been identified This article explores kernel sctp. . This flaw allows attackers to escalate privileges from unprivileged local access to full root and even escape containers to compromise the underlying host.
The bug is a use-after-free issue within the kernel's SCTP Dynamic Address Reconfiguration feature, with its origins tracing back to code introduced in Linux 2.6.25 in December 2007. The flaw arises from an identity mismatch between the source address validation performed by the kernel during a DEL-IP delete operation and the cached pointer used for selecting actual network paths.
By crafting an ordered ASCONF sequence that specifies an address, deletes it, and then sends a wildcard delete, an attacker can trick the kernel into removing a transport while leaving behind a stale reference to it in association's active and primary path pointers. This allowed the attacker to construct a fake object graph that triggered commit_creds, granting global root privileges without requiring shellcode or traditional ROP chains. By utilizing per-socket SCTP options instead of system-wide sysctls, the exploit circumvented the need for elevated capabilities, successfully breaking out of containers running default seccomp profiles in six out of eight attempts.
System administrators running SCTP-enabled kernels, especially in multi-tenant or containerized environments, should prioritize patching to the fixed kernel versions immediately due to the demonstrated ease of exploitation and severe impact.
