Linux Kernel futex_requeue Local Privilege Escalation Vulnerability (CVE-2014-3153, Towelroot)

1. Vulnerability Overview & Root Cause

This vulnerability, widely known as 'Towelroot', resides in the Fast Userspace Mutex (Futex) subsystem within kernel/futex.c of the Linux kernel. The root cause is a design flaw in the futex_requeue function, which fails to validate whether the two futex addresses provided in the system call are distinct. This lack of validation allows an attacker to trigger a requeue operation on the same futex address, leading to unsafe modification of the kernel's internal waiter structures.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by orchestrating a specific sequence of FUTEX_WAIT_REQUEUE_PI and FUTEX_REQUEUE (or FUTEX_CMP_REQUEUE_PI) system calls.

• The attacker first queues a waiter on a futex, which allocates an rt_mutex_waiter structure on the kernel stack.
• By calling FUTEX_REQUEUE with identical source and target futex addresses, the kernel is tricked into manipulating the waiter list unsafely.
• This results in a dangling pointer or double-linked list corruption on the kernel stack (Unsafe Waiter Modification).
• The attacker leverages this corrupted state to achieve arbitrary kernel memory write capabilities, subsequently overwriting the process's credential structure to elevate privileges to root (UID 0).

3. Infrastructure & Business Impact

As a Local Privilege Escalation (LPE) vulnerability, this is highly critical because it allows any user with local shell access (or an attacker who has established a foothold via web application compromise) to gain absolute control over the host. This vulnerability is actively exploited in the wild (listed in CISA KEV) and has been historically used for rooting Android devices. In cloud and containerized environments, this can facilitate container escape, compromising the underlying host and all adjacent tenants.