U.S. CISA adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog

ImageTragick (CVE-2016-3714) is an improper input validation flaw in ImageMagick's EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders that allows shell metacharacters embedded in a crafted image to be passed to the command shell. It is triggered whenever ImageMagick processes a malicious image file — typically when a web application converts or thumbnails user-supplied uploads or URLs. A successful attacker gains arbitrary command and code execution on the host running ImageMagick, with the privileges of that process. Anyone running affected versions of ImageMagick — before 6.9.3-10 in the 6.x line or before 7.0.1-1 in the 7.x line, including builds shipped with Ubuntu, Debian, openSUSE/Leap and SUSE Linux Enterprise Server — is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09, and EPSS places its 30-day exploitation probability at 97.5% (100th percentile), consistent with active exploitation.

Do: Upgrade ImageMagick to 6.9.3-10 or later (6.x) or 7.0.1-1 or later (7.x), or apply the security updates issued by Ubuntu, Debian, openSUSE and SUSE. As an interim mitigation, disable or restrict the vulnerable coders (EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, PLT) via ImageMagick's policy.xml and avoid passing user-controlled filenames or URLs unfiltered to ImageMagick. Prioritize auditing internet-facing services that process user-uploaded images (CMSs, forums, image pipelines), which are the typical delivery path for this flaw.

CVE-2017-1000253 is a memory-corruption flaw (CWE-119) in the Linux kernel's ELF binary loader: when CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE is enabled with a top-down allocation strategy, load_elf_binary() maps a PIE (position-independent executable) immediately below mm->mmap_base without reserving space for the entire binary, so subsequent PT_LOAD segments are mapped above mmap_base into the gap reserved between the stack and the binary. Any local user can trigger the flaw simply by executing a PIE binary on an affected unpatched long-term kernel. The resulting corruption of the stack region yields local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected systems are Linux distributions running long-term kernels that lack the April 2015 fix commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 — notably Red Hat Enterprise Linux and CentOS kernels — where the fix was applied but not recognized as a security issue at the time. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and EPSS assigns a 10.7% probability of exploitation within 30 days (96th percentile); no public PoC is known.

Do: Update affected systems to kernel packages that include commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (upstream since April 2015 and backported to Linux 3.10.77), or move to a currently supported kernel branch; per CISA KEV, apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Prioritize legacy RHEL/CentOS and other long-lived LTS deployments — especially internet-facing or ransomware-targeted servers — and check whether running kernels are built with CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE and allow unprivileged users to execute PIE binaries.

CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicWall SonicOS management access that can allow unauthorized access to protected resources and, under specific conditions, crash the affected firewall. It is network-exploitable without privileges or user interaction per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and affects Gen 5 and Gen 6 appliances as well as Gen 7 devices running SonicOS 7.0.1-5035 or older. A successful attacker gains unauthorized access to resources behind or on the appliance and can potentially take the firewall offline, creating opportunities for follow-on attacks such as VPN account compromise and ransomware deployment. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and recent reporting ties Akira ransomware activity — including MFA bypass on SonicWall VPNs affecting over 100 accounts — to this legacy bug combined with password reuse. No public PoC is known, but EPSS assigns an ~18.2% probability of exploitation within 30 days (97th percentile).

Do: Upgrade Gen 7 appliances to SonicOS 7.0.1-5037 or later (the fixed release beyond the affected 7.0.1-5035) and move Gen 5/6 devices to the latest SonicOS release SonicWall supports for those generations; per CISA KEV guidance, apply vendor mitigations or discontinue use if patching is not possible. Restrict WAN-side management and SSLVPN access to trusted sources, audit VPN accounts for password reuse, rotate credentials and any locally stored recovery codes, and review logs for signs of Akira-related compromise such as MFA bypass or disabled EDR agents.