« Volver al listado

CVE-2025-13350

Estado: Pendiente de análisisAlta (7.1)—

Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF).

Leer descripción completaMostrar menos

Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UAF en garbage collector de AF_UNIX con acceso local privilegiado (PR:L) permite escalada de privilegios confiable (VI:H, SA:H). Ejecución de código en kernel context y acceso root.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ubuntu — Ubuntu LinuxAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-13350",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-13350",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-06T10:37:26.433118Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "repo": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/",
          "vendor": "Canonical",
          "modules": [
            "AF_UNIX"
          ],
          "product": "Ubuntu Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8.0-56.58",
              "lessThan": "6.8.0-84.84",
              "versionType": "dpkg"
            }
          ],
          "packageName": "linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "collectionURL": "https://launchpad.net/ubuntu/+source/",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "unix_gc()"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-05T20:16:10.730",
  "references": [
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2121515",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble/commit/?id=79cbc2a1d4f61e492ddac5da65b075836675f94d",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/05/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ubuntu.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 (\"af_unix: Don’t call skb_get() for OOB skb\"). When orphaned MSG_OOB sockets hit unix_gc(), the garbage collector still calls kfree_skb() as if OOB SKBs held two references; on Ubuntu Linux 6.8 (Noble Numbat) kernel tree, they have only the queue reference, so the buffer is freed while still reachable and subsequent queue walks dereference freed memory, yielding a reliable local privilege escalation (LPE) caused by a use-after-free (UAF). Ubuntu builds that have already taken the new GC stack from commit 4090fa373f0e, and mainline Linux kernels shipping that infrastructure are unaffected because they no longer execute the legacy collector path. This issue affects Ubuntu Linux from 6.8.0-56.58 before 6.8.0-84.84."
    },
    {
      "lang": "es",
      "value": "Ubuntu Linux 6.8 GA conserva el recolector de basura AF_UNIX heredado pero incorpora el commit upstream 8594d9b85c07 ('af_unix: No llamar a skb_get() para OOB skb'). Cuando los sockets MSG_OOB huérfanos alcanzan unix_gc(), el recolector de basura sigue llamando a kfree_skb() como si los SKB OOB tuvieran dos referencias; en el árbol del kernel de Ubuntu Linux 6.8 (Noble Numbat), solo tienen la referencia de la cola, por lo que el búfer se libera mientras aún es accesible y las subsiguientes recorridos de cola desreferencian memoria liberada, lo que produce una escalada de privilegios local (LPE) fiable causada por un uso después de liberación (UAF). Las compilaciones de Ubuntu que ya han adoptado la nueva pila GC del commit 4090fa373f0e, y los kernels de Linux principales que distribuyen esa infraestructura no se ven afectados porque ya no ejecutan la ruta del recolector heredado. Este problema afecta a Ubuntu Linux desde 6.8.0-56.58 antes de 6.8.0-84.84."
    }
  ],
  "lastModified": "2026-06-17T08:33:58.420",
  "sourceIdentifier": "security@ubuntu.com"
}