InfoSecBulletin Cybersecurity for mankind
A PoC exploit for CVE-2025-38352, a critical race condition flaw in the Linux kernel, is now available on GitHub. A vulnerability found this year affects POSIX CPU timers and had been used in targeted attacks on 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel’s handle_posix_cpu_timers() function. The flaw arises when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled, which is common in most 32-bit Android kernels but not in 64-bit ones.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
The vulnerability arises from a race condition that occurs when POSIX CPU timers fire on zombie tasks. Attackers can exploit a zombie process by timing its creation and reaping it via a parent process. This may trigger the kernel to access freed memory, resulting in privilege escalation or kernel code execution.
Chronomaly Exploit:
Security researcher Faith (working at blockchain security firm Zellic) has released “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x. A three-part blog series detailed the discovery, analysis, and exploitation techniques of the vulnerability.
The exploit is significant because it doesn’t need kernel symbol offsets or specific memory addresses, making it versatile across various kernel setups.
It uses advanced techniques to extend race windows by manipulating CPU timers and allocating cache for sigqueue structures. The exploit needs a multi-core system with at least two CPUs to effectively trigger the race condition.
Testing shows successful exploitation of QEMU-virtualized Linux kernels version 5.10.157, with adjustable parameters for various environments. CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog, showing it is being actively exploited.
The threat mainly impacts 32-bit Android devices, but the kernel components are also found in 32-bit versions of other Linux-based systems.
According to the GitHub advisory, users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks.
Device makers and system admins should focus on kernel updates to fix this serious vulnerability.
