Exploiting Recursion in the Linux Kernel
Summary: On June 1st, 2016, Jann Horn of Google Project Zero reported an arbitrary recursion bug in the Linux kernel that a local user can trigger on Ubuntu systems installed with home directory encryption support. The bug chains ecryptfs mounts backed by /proc/$pid files so that pagefaults recurse through environ and cmdline reads, overflowing the short kernel stack, which is 16384 bytes on x86-64 and allocated without guard pages.
Key Takeaway: Exploiting it requires only the ecryptfs-utils package that Ubuntu installs when home directory encryption is enabled, and the /sbin/mount.ecryptfs_private setuid helper lets an unprivileged user mount ecryptfs with /proc/$pid as the source. A local user with no root privileges can therefore drive the kernel stack into adjacent memory and crash the kernel.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026