CISA adds Ruckus bug and another six flaws to its Known Exploited Vulnerabilities catalog

Linux Kernel contains an improper input validation flaw (CWE-20) in its Reliable Datagram Sockets (RDS) protocol implementation, which mishandles data passed through the sendmsg and recvmsg system calls. A local user who can create an RDS socket and issue crafted sendmsg/recvmsg calls triggers the flaw and corrupts kernel memory. Successful exploitation yields local privilege escalation, allowing an unprivileged user to execute code with elevated (root) privileges. Any Linux system whose kernel includes RDS support is affected, though specific version ranges are not provided in the available data, and exploitation requires an attacker to already have some local foothold on the machine. CISA added CVE-2010-3904 to the Known Exploited Vulnerabilities catalog on 2023-05-12, confirming active exploitation (ransomware use unknown); EPSS estimates a 14.6% probability of exploitation in the next 30 days (96th percentile), and no public proof-of-concept is catalogued.

Do: Install your distribution's updated kernel packages containing the RDS input-validation fix (vendors have long backported this patch) and reboot into the patched kernel. Verify whether RDS is present and loadable (e.g., check 'lsmod | grep rds' and /proc/net/rds) and restrict unprivileged local shell access, since exploitation requires local code execution. Per CISA's KEV required action, the impacted product is end-of-life, so disconnect or decommission systems still running unpatched/EOL kernels, and monitor for Linux-targeting campaigns such as UAT-10147, which deploys EDR bypass and Linux rootkits that pair naturally with local privilege escalation flaws.

CVE-2014-0196 is a race condition (CWE-362) in the n_tty_write function of the Linux kernel's TTY line discipline, where concurrent read and write operations involving long strings can corrupt memory. A local user triggers it by running a crafted program that performs simultaneous reads and writes of long data strings against a terminal (TTY) device, such as a PTY. Successful exploitation can crash the system (denial of service) or, in favorable memory layouts, let the local user execute code with elevated privileges; because it requires local access, a remote attacker would first need a foothold on the machine. Any Linux deployment running a vulnerable, unpatched kernel is affected, with the greatest risk on legacy or end-of-life systems that never received the 2014 fixes and on multi-user machines where untrusted users can open TTYs. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-05-12, indicating exploitation in the wild; ransomware use is unknown, no public proof-of-concept is catalogued here, and EPSS estimates roughly a 22.5% chance of exploitation in the next 30 days (98th percentile).

Do: Patch kernels on all affected hosts with a kernel containing the May 2014 n_tty_write race fix (upstream 3.14.4 or later, or your distribution's backport). Because CISA states the impacted product is end-of-life, prioritize legacy appliances, embedded devices and OS builds that no longer receive kernel updates, and disconnect or replace any EOL system that cannot be patched. In the interim, restrict untrusted local shell access, since exploitation requires the ability to read and write long strings to a TTY.

CVE-2015-5317 is an information disclosure flaw (CWE-200) in the Jenkins user interface in which the "Fingerprints" pages reveal the names of jobs and builds that a given user is not authorized to access. It is triggered when an authenticated, restricted user opens the Fingerprints pages in the Jenkins web UI, where fingerprint entries leak the names of otherwise-inaccessible jobs and builds. An attacker with valid low-privileged credentials gains visibility into the names and structure of restricted projects, which is useful for reconnaissance in a multi-user Jenkins environment; no code execution is implied by the flaw description. Any multi-user Jenkins deployment that restricts job or build visibility for some users is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-05-12), indicating exploitation in the wild, though no public proof-of-concept is known, ransomware use is unknown, and EPSS estimates a 22.4% probability of exploitation within 30 days (98th percentile); CVSS is not yet scored.

Do: Apply updates per vendor instructions, the required action in CISA's KEV catalog, by upgrading Jenkins to a current supported release per Jenkins security advisories. In the interim, restrict which users can reach the Fingerprints pages in the Jenkins UI and review job-access permissions. Because the flaw is confirmed exploited in the wild, check access logs for authenticated users querying fingerprint pages, particularly on internet-reachable Jenkins servers.

CVE-2016-3427 is an improper access-control flaw (CWE-284) in the JMX (Java Management Extensions) component of Oracle Java SE 6u113, 7u99, and 8u77, Java SE Embedded 8u77, and JRockit R28.3.9. Because the flaw is network-exploitable without privileges or user interaction (CVSS 3.1: 9.8), a remote, unauthenticated attacker can trigger it by sending crafted traffic to JMX-related interfaces on systems running the affected runtimes. Successful exploitation affects confidentiality, integrity, and availability, i.e., effectively a full compromise of the affected Java process, enabling data theft, tampering, and denial of service. Anyone running the affected Java or JRockit versions is exposed, including Linux distributions that package the JDK/JRE and NetApp E-Series SANtricity and OnCommand products that bundle affected Java. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-05-12, confirming active exploitation, and its EPSS score (~92%, 100th percentile) indicates a very high probability of exploitation; no public proof-of-concept is known.

Do: Upgrade Java SE/JDK/JRE to releases newer than 8u77, 7u99, and 6u113 (apply Oracle's April 2016 Critical Patch Update fixes or later, or current supported Java releases), move JRockit beyond R28.3.9, and update Java SE Embedded beyond 8u77; for NetApp E-Series and OnCommand products, apply the vendor's updated releases containing fixed Java. As an interim mitigation, restrict remote JMX access to trusted management networks and monitor for anomalous JMX/RMI connections. Patching is required under CISA KEV (apply updates per vendor instructions).

CVE-2016-8735 is a remote code execution flaw in Apache Tomcat's bundled JmxRemoteLifecycleListener, which was not updated for consistency with Oracle's patch for the related JMX issue CVE-2016-3427, leaving its credential handling insecure. The flaw can be triggered only when this listener is in use and an attacker can reach the server's JMX ports over the network; no authentication or user interaction is required (CVSS 9.8). Successful exploitation lets an attacker execute arbitrary code in the context of the Tomcat process. It affects Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, as well as Tomcat-containing products from Canonical, Debian, Red Hat, NetApp, and Oracle. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-05-12, indicating observed exploitation in the wild, and EPSS assigns a roughly 90% probability of exploitation within 30 days (99th percentile), although no public PoC is known.

Do: Upgrade Tomcat to 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 or later, or apply vendor-patched packages/deliverables from Canonical, Debian, Red Hat, NetApp, or Oracle, per CISA's required action. Where upgrades are not immediate, remove or disable the JmxRemoteLifecycleListener or firewall the JMX ports so they are unreachable from untrusted networks. Inventory all Tomcat instances and Tomcat-embedding products (NetApp, Red Hat JBoss EWS, Oracle, distro packages) and confirm whether the JMX remote listener is enabled and exposed; ransomware use is unknown but KEV listing mandates patching by the required due date.

Red Hat's Polkit (PolicyKit), the component that enforces authorization policy for privileged D-Bus requests, fails to correctly verify credentials for D-Bus requests: when the calling client drops its connection before the authorization check completes, Polkit treats the request as if it came from a privileged process. A local, unprivileged user can trigger this by initiating a D-Bus call to a system service and terminating the connection at the right moment, making the race straightforward to hit with repeated attempts. A successful exploit bypasses the credential check and escalates the attacker's privileges to root on the affected host. Any Red Hat system shipping the vulnerable Polkit build is affected, and no public proof-of-concept is documented. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2023-05-12), which indicates known exploitation in the wild, though ransomware use is unknown.

Do: Apply updated Polkit packages per Red Hat's advisory instructions on all affected systems, and verify the running Polkit version matches the vendor's fixed release. Because the flaw is CISA KEV-listed with a 22.2% EPSS, prioritize patching on multi-user and internet-exposed hosts; where patching is delayed, restrict local shell access to untrusted users, since the flaw requires local access to trigger.

CVE-2023-25717 is a command-injection flaw (CWE-94) in Ruckus Wireless Admin through version 10.4, the management interface used with Ruckus/CommScope SmartZone controllers. An unauthenticated attacker triggers it by sending a crafted HTTP GET request to /forms/doLogin, injecting shell commands (e.g., $(curl ...) substrings) into the login_username or password parameters, which the device executes. Successful exploitation yields remote code execution with full compromise of the management interface, and the same code path is also tied to CSRF/SSRF issues. Any organization running an internet-exposed Ruckus Wireless Admin or SmartZone management endpoint is affected, and the flaw has been actively exploited in the wild — botnet campaigns (notably Andoryu) used it to recruit devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-12; EPSS puts the 30-day exploitation probability at 98.1%.

Do: Apply vendor updates per Ruckus/CommScope instructions for Wireless Admin (beyond 10.4) and SmartZone firmware, and per CISA KEV guidance disconnect any product that is end-of-life if it cannot be patched. Restrict the management interface so /forms/doLogin is not reachable from the internet, and review access logs for unauthenticated GET requests containing shell syntax such as $( ) in the login_username or password parameters to detect prior exploitation.