Forest Global Training Partners

Cyber Risks · Google Project Zero

From Chrome renderer code exec to kernel with MSG_OOB

Summary: Google Project Zero found CVE-2025-38236, a use-after-free in the Linux kernel's MSG_OOB handling for stream-oriented UNIX domain sockets, affecting Linux 6.9 and later; the bug was reachable inside the Chrome renderer sandbox because the sandbox allowed AF_UNIX stream sockets and did not filter send()/recv() flags. The flaw traces to a mid-2024 fix for a spurious recv() return of 0, which left manage_oob() able to free an SKB while ->oob_skb still pointed to it, and the researcher built an exploit escalating from native code execution in the Chrome renderer to the kernel on x86-64 Debian Trixie.

Bottom line: The feature at the root of this, MSG_OOB on AF_UNIX sockets, is used almost nowhere except Oracle products and was proposed for removal in 2024, yet it was enabled by default and could not be disabled until December 2024 - an esoteric kernel path that a browser sandbox exposed without anyone intending it.

Read the original at Google Project Zero ↗

Topics
Zero-Days & Exploits
Mentions
CVE-2025-38236
Related