A newly discovered Linux kernel vulnerability, known as SCTPhantom, enables local attackers to elevate privileges to root and escape container environments by exploiting an 18-year-old flaw in the SCTP’s Dynamic Address Reconfiguration (ASCONF) code This article explores vulnerability known sctphantom. . The vulnerability arises from an inconsistency between the IPv4 packet source address (S) used for validation checks and the Address Parameter (L) utilized to select the actual transport during SCTP’s ASCONF chunk processing.
By crafting a specific sequence of [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0], an attacker can manipulate the association, causing the primary_path and active_path pointers to reference a dead transport.
Security firm Corvus AI (developed jointly with TencentOS Security Team / Tencent Zhuque Lab) transformed the initial finding into a full exploit chain using an automated, multi-agent vulnerability research pipeline. From there, a repeatable 4-byte kernel read primitive is built using SCTP_STATUS and sctp_assoc2id, and this read primitive is used to defeat KASLR through the CPU entry area’s IDT mapping. By enabling SCTP_ASCONF_SUPPORTED and SCTP_AUTH_SUPPORTED on per-socket basis and including valid AUTH chunks, an attacker inside a default-seccomp container can trigger the same shared-kernel UAF, pivoting to call_usermodehelper_exec() and executing operations in the host’s initial namespaces.
- Since a kernel version string alone doesn’t guarantee patch status on vendor kernels, directly checking vendor advisories is essential before assuming exposure has been resolved.
