ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI publishes ZDI-26-575, a CVSS 7.5 TOCTOU local privilege escalation in the Linux kernel net scheduler packet classifier API.
The Zero Day Initiative disclosed a time-of-check time-of-use flaw in the Linux kernel's net scheduler packet classifier API that permits local privilege escalation. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5; no CVE id is provided in the text.
- TOCTOU LPE in Linux kernel net scheduler packet classifier API
- Requires prior high-privileged code execution to exploit
- CVSS 7.5, published as ZDI-26-575
- Vendors
- Linux Kernel
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.