A newly discovered Linux kernel vulnerability, dubbed ZcopyReaper, enables an unprivileged local attacker to elevate privileges and potentially gain root-level control This article explores memory cleanup rds. . The vulnerability arises from incorrect memory cleanup when an RDS zero-copy send operation fails after user-space pages have been pinned but before the associated message is attached to the sending socket.
The affected purge path determines the cleanup method based on the message's socket association, but it should instead be determined by the presence of the op_mmp_znotifier structure. Disabling unprivileged user namespace creation does not prevent the demonstrated attack, a significant detail for organizations relying on such restrictions as part of their Linux hardening strategy.
When RDS support is modular, the rds.ko and rds_tcp.ko modules must be loaded or accessible through automatic module loading for an attacker to exploit the vulnerability. Improper memory cleanup prior to socket attachment bypasses op_mmp_znotifier checks, corrupting kernel memory. The upstream fix, commit 44b550d88b26, was introduced in Linux 7.1-rc3 and has been backported to Ubuntu 7.0.0, 6.8.0, and 5.15.0, as well as Debian branches.
Stable distributions have started rolling out the patch; Ubuntu lists fixes for supported kernels including 7.0.0-28, 6.8.0-136, and 5.15.0-186. NebuSec confirmed exploitability and produced public exploits for 20 additional Linux kernel vulnerabilities, available in the company's CyberMeowfia security-research repository.
