use-after-free news
2 stories
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A significant vulnerability has been identified and patched in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw, a use-after-free bug present for 18 years, could allow local users to escalate their privileges to root and potentially escape containerized environments. Researchers from Tencent are credited with discovering and demonstrating the…
ZDI-26-397: X.Org Server CreateSaverWindow Use-After-Free Information Disclosure Vulnerability
A critical use-after-free vulnerability has been identified in the X.Org Server, potentially leading to sensitive information disclosure and privilege escalation. The vulnerability, tracked as ZDI-26-397, resides in the server's management of ScreenSaverScreenPrivateRec objects. It arises from an insufficient validation process, where the server performs operations on an object without first…