InfoSecBulletin Cybersecurity for mankind
A PoC exploit for CVE-2025-38352, a critical race condition flaw in the Linux kernel, is now available on GitHub. A vulnerability found this year affects POSIX CPU timers and had been used in targeted attacks on 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel’s handle_posix_cpu_timers() function. The flaw arises when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled, which is common in most 32-bit Android kernels but not in 64-bit ones.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The vulnerability arises from a race condition that occurs when POSIX CPU timers fire on zombie tasks. Attackers can exploit a zombie process by timing its creation and reaping it via a parent process. This may trigger the kernel to access freed memory, resulting in privilege escalation or kernel code execution.
Chronomaly Exploit:
Security researcher Faith (working at blockchain security firm Zellic) has released “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x. A three-part blog series detailed the discovery, analysis, and exploitation techniques of the vulnerability.
The exploit is significant because it doesn’t need kernel symbol offsets or specific memory addresses, making it versatile across various kernel setups.
It uses advanced techniques to extend race windows by manipulating CPU timers and allocating cache for sigqueue structures. The exploit needs a multi-core system with at least two CPUs to effectively trigger the race condition.
Testing shows successful exploitation of QEMU-virtualized Linux kernels version 5.10.157, with adjustable parameters for various environments. CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog, showing it is being actively exploited.
The threat mainly impacts 32-bit Android devices, but the kernel components are also found in 32-bit versions of other Linux-based systems.
According to the GitHub advisory, users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks.
Device makers and system admins should focus on kernel updates to fix this serious vulnerability.
