Experts found a new powerful modular Linux cryptominer

The Linux kernel's perf event subsystem fails to validate all 64 bits of the attr.config value supplied from user space, causing an out-of-bounds access to the perf_swevent_enabled array in sw_perf_event_destroy(). A local attacker triggers the flaw by creating a perf event with a crafted attr.config value, and the out-of-bounds access occurs when that event is destroyed, corrupting adjacent kernel memory. By corrupting memory this way, an attacker can escalate privileges from an unprivileged local user to kernel-level (root) privileges on the affected system. Any system running an affected Linux kernel where perf events are available is exposed; the provided data does not specify exact affected kernel version ranges, so operators should confirm against vendor advisories. The vulnerability is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, and EPSS assigns it a 47.7% probability of exploitation within 30 days (99th percentile).

Do: Apply kernel updates per vendor instructions as required by CISA, then reboot so the system runs the patched kernel. As interim mitigation, restrict unprivileged access to perf events (e.g., by raising the perf_event_paranoid sysctl) and limit untrusted local shell access. Verify the running kernel version against your distribution's advisory for this CVE before and after remediation.

CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile).

Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution.