The Patching Friars' AlmanacA calendar of CVE saints

November 26

RetSpillHoly card for retspill, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 user user kernel RetSpill RELIQUIAE IN STACK
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint RetSpill, Who Spilled the Leftovers Onto the Stack

Patron of Linux kernels, user data forgotten on the kernel stack, and everyone who turns a crash into a shell.

Life

In 2023 the researchers behind RetSpill showed a general technique for exploiting Linux kernel bugs: when the kernel switches to running its own code, the stack still holds user-controlled values. RetSpill "spilled" them into the kernel's execution flow, turning many hard vulnerabilities into reliable code execution. It was demonstrated against a long series of old kernel bugs.

Prayer

O Saint RetSpill, who gathers the user's leftovers on the kernel stack, let our kernel not trust what it finds there. Amen.

How to celebrate

Celebrated by updating the kernel and hardening the defences that scrub user state before entering the kernel.

Leftovers on the stack, a shell served to the kernel.

Technical record

Disclosed on
November 26 2023
CVE
CVE-2010-2959CVE-2016-0728CVE-2017-2636CVE-2018-6555CVE-2021-3490CVE-2022-0185
CVSS
8.4Actively exploited (CISA KEV)
Product
Linux Kernel · Linux Kernel

Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.

Sources: kylebot.net · github.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.