InfoSecBulletin Cybersecurity for mankind
A PoC exploit for CVE-2025-38352, a critical race condition flaw in the Linux kernel, is now available on GitHub. A vulnerability found this year affects POSIX CPU timers and had been used in targeted attacks on 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel’s handle_posix_cpu_timers() function. The flaw arises when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled, which is common in most 32-bit Android kernels but not in 64-bit ones.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
The vulnerability arises from a race condition that occurs when POSIX CPU timers fire on zombie tasks. Attackers can exploit a zombie process by timing its creation and reaping it via a parent process. This may trigger the kernel to access freed memory, resulting in privilege escalation or kernel code execution.
Chronomaly Exploit:
Security researcher Faith (working at blockchain security firm Zellic) has released “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x. A three-part blog series detailed the discovery, analysis, and exploitation techniques of the vulnerability.
The exploit is significant because it doesn’t need kernel symbol offsets or specific memory addresses, making it versatile across various kernel setups.
It uses advanced techniques to extend race windows by manipulating CPU timers and allocating cache for sigqueue structures. The exploit needs a multi-core system with at least two CPUs to effectively trigger the race condition.
Testing shows successful exploitation of QEMU-virtualized Linux kernels version 5.10.157, with adjustable parameters for various environments. CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog, showing it is being actively exploited.
The threat mainly impacts 32-bit Android devices, but the kernel components are also found in 32-bit versions of other Linux-based systems.
According to the GitHub advisory, users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks.
Device makers and system admins should focus on kernel updates to fix this serious vulnerability.
