Extremely serious vulnerability on Linux, currently unknown, discovered by EvilSocket

Marco Marcoaldi · Managed Server ·

8 min read Original article ↗

In the cybersecurity landscape, a new critical vulnerability is shaking the GNU/Linux world. Discovered and reported by Simone Margaritelli , a renowned cybersecurity researcher and creator of numerous cybersecurity tools, this vulnerability is causing a wave of concern among major Linux distributions such as Ubuntu (Canonical) and Red Hat , which have already confirmed the seriousness of the problem. With a score of 9.9/10 on the CVSS severity scale , it represents a potential security nightmare for millions of systems worldwide.

Simone Margaritelli, also known as evilsocket in his professional profiles, is one of the most recognized names in the cybersecurity community. His discoveries and the tools he developed have had a profound impact on the world of cybersecurity, and his dedication to disclosing critical vulnerabilities like the one discussed here is nothing new. Despite his intention to proceed with responsible disclosure of the flaw, the resistance Margaritelli encountered during the process led to a drastic decision: to announce a full disclosure within the next few weeks, even without a patch available.

Key points of vulnerability

Three weeks ago, Margaritelli discovered an unauthenticated Remote Code Execution (RCE) vulnerability affecting all GNU/Linux systems and, likely, other platforms. An RCE vulnerability allows a remote attacker to execute arbitrary code on a vulnerable system without authentication. This particular vulnerability is extremely dangerous, and the fact that a working fix has yet to be released further exacerbates the situation.

According to a post shared by Margaritelli himself on Twitter, Canonical and Red Hat have confirmed the criticality of the vulnerability, which received a CVSS score of 9.9 out of 10. This means that this flaw has a devastating impact on security and could lead to widespread exploitation by cybercriminals if not addressed promptly. At this time, however, no CVE (Common Vulnerabilities and Exposures) has been assigned , although Margaritelli notes that there should be at least three or four CVEs for different aspects of this vulnerability.

The lack of a working fix or patch has sparked debate within the developer community, with many appearing to downplay the impact of some of the vulnerabilities found. This attitude led Margaritelli to express his frustration on Twitter, stating that his experience in recent weeks has been marked by resistance from developers, who seem unwilling to accept that the code underlying these vulnerabilities is indeed flawed.

Margaritelli stated that, despite attempting to follow responsible disclosure protocol , working with development teams to identify and resolve issues to protect users, the process was hampered by uncooperative behavior. Because of this, he has decided to discontinue responsible disclosure and proceed with a full disclosure of the vulnerability within the next few weeks.

CVSS 9.9 vulnerability

The vulnerability in question has been classified with a CVSS v3.1 score of 9.9/10 , a clear indication of the extreme threat level. Looking in more detail at the factors that contributed to this score:

  • Attack Vector (AV): Network (N) — The vulnerability can be exploited remotely over the network, without requiring physical access to the target machine.
  • Attack Complexity (AC): Low (L) — Exploitation of the vulnerability requires few or no special prerequisites, meaning that the attack can be easily performed by anyone with basic knowledge.
  • Privileges Required (PR): None (N) — An attacker does not need to gain administrator or user privileges to exploit the flaw, making the vulnerability even more accessible and dangerous.
  • User Interaction (UI): None (N) — The attack requires no user interaction, which increases the risk of surprise exploitation.
  • Confidentiality (C): Low (L) — Privacy breach is considered less impactful than other metrics, but remains significant.
  • Integrity (I): High (H) — The vulnerability could compromise the integrity of the system, allowing unauthorized changes.
  • Availability (A): Low (L) — The vulnerability has a moderate impact on system availability, but under certain conditions could lead to outages or malfunctions.

These combined factors make this one of the most serious vulnerabilities to emerge in recent times in the GNU/Linux world, and the lack of an available fix is ​​a cause for great concern for anyone using Linux systems on a large scale, especially in enterprise and data center settings.

Currently there is no indication whatsoever as to which service may be affected by this vulnerability, but it is reasonable to assume that it may concern a known exposed service such as OpenSSH, or possibly filtering services such as Net Filter. Obviously these are just hypotheses.

Simone Margaritelli's frustration

In his Twitter post, Margaritelli made it clear that he was frustrated with how some developers handled the issue. Although he spent three full weeks of his free time researching and coordinating to resolve the issue, the lack of support and downplaying of risk by some developers pushed him to take a different path.

Simone Margaritelli EvilSocket Linux Vulnerability

Simone said he was ignored, and that many developers seemed reluctant to admit that their code might be flawed. This fueled his decision to abandon the idea of ​​responsible disclosure and proceed with a full disclosure of the vulnerability, making the technical details public within the next few weeks.

This decision is extremely significant, as it could speed up the race to implement a fix, but at the same time it will expose millions of Linux systems to the risk of attacks by malicious actors if rapid countermeasures are not taken.

Simone Margaritelli: who he is and why he is important

Simone Margaritelli, aka evilsocket , is a prominent name in the cybersecurity community. Over the course of his career, he has developed numerous tools used by both cybersecurity professionals and researchers worldwide.

One of his best-known contributions is the development of Bettercap , an open-source tool designed to conduct Man-in-the-Middle (MITM) attacks and network penetration testing. Bettercap is one of the most versatile network security tools available and is used by thousands of professionals to identify vulnerabilities, intercept network traffic, and conduct in-depth security testing on corporate systems and local networks.

Bettercap is appreciated for its modularity and flexibility. It allows users to monitor and manipulate traffic in real time, analyze network packets, and even perform complex attacks such as DNS spoofing , content injection into web pages, and many other types of attacks used to test the strength of a network's defenses.

You can find more details about Bettercap and download the tool by visiting the official website: Bettercap Project.

Margaritelli is also known for developing several other security tools, many of which are collected in his personal blog and GitHub profile, which you can visit here:

Bettercap: An indispensable tool for penetration testing

Bettercap is a tool designed to provide a comprehensive suite of network security tools, including the ability to perform MITM attacks , traffic manipulation, and real-time network monitoring. Initially created as a modern alternative to tools like Ettercap , Bettercap has quickly grown to become one of the most powerful network security tools available today.

Bettercap's key features include:

  • Modularity: Bettercap supports numerous modules that allow users to perform different types of attacks and analysis, such as HTTP traffic monitoring, content injection, and sniffing of credentials.
  • Multi-platform support: Bettercap can run on multiple operating systems, including GNU/Linux, Windows, and macOS, making it extremely versatile.
  • Extensibility: Users can write their own modules and scripts to extend the functionality of Bettercap, tailoring it to their specific needs.

One of the reasons why Bettercap is so popular is its simple yet powerful interface, which allows even those with basic network security skills to run complex tests with relative ease. Due to its versatility, Bettercap is used not only in security testing, but also for training security professionals and for educational purposes in universities.

Conclusions

The vulnerability discovered by Simone Margaritelli represents one of the most serious security threats to the GNU/Linux landscape in recent times . With a CVSS score of 9.9 out of 10 , the vulnerability has a devastating impact on system security, allowing a remote attacker to take control of a machine without authentication or elevated privileges.

Margaritelli, despite his efforts to coordinate with developers and resolve the issue responsibly, faced significant resistance, leading him to decide to proceed with a full disclosure within the next few weeks.

His frustration is understandable: time is of the essence when dealing with vulnerabilities of this magnitude, and every day that passes without a fix increases the risk of a full-scale attack. Users of GNU/Linux systems, especially in enterprise or data center settings, should pay attention to security updates and make sure to take all possible preventative measures while waiting for a patch.

If you want to learn more about Simone Margaritelli's work or use his tools to test the security of your networks, I recommend you visit the following links:

Stay tuned for further developments on this very serious vulnerability, as full disclosure could come very soon, with all the security implications that this entails.