InfoSecBulletin Cybersecurity for mankind
A PoC exploit for CVE-2025-38352, a critical race condition flaw in the Linux kernel, is now available on GitHub. A vulnerability found this year affects POSIX CPU timers and had been used in targeted attacks on 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel’s handle_posix_cpu_timers() function. The flaw arises when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled, which is common in most 32-bit Android kernels but not in 64-bit ones.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
The vulnerability arises from a race condition that occurs when POSIX CPU timers fire on zombie tasks. Attackers can exploit a zombie process by timing its creation and reaping it via a parent process. This may trigger the kernel to access freed memory, resulting in privilege escalation or kernel code execution.
Chronomaly Exploit:
Security researcher Faith (working at blockchain security firm Zellic) has released “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x. A three-part blog series detailed the discovery, analysis, and exploitation techniques of the vulnerability.
The exploit is significant because it doesn’t need kernel symbol offsets or specific memory addresses, making it versatile across various kernel setups.
It uses advanced techniques to extend race windows by manipulating CPU timers and allocating cache for sigqueue structures. The exploit needs a multi-core system with at least two CPUs to effectively trigger the race condition.
Testing shows successful exploitation of QEMU-virtualized Linux kernels version 5.10.157, with adjustable parameters for various environments. CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog, showing it is being actively exploited.
The threat mainly impacts 32-bit Android devices, but the kernel components are also found in 32-bit versions of other Linux-based systems.
According to the GitHub advisory, users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks.
Device makers and system admins should focus on kernel updates to fix this serious vulnerability.
