CVE-2013-4312

What it actually does

The flaw permits a local process to transmit file descriptors across UNIX domain sockets without immediately closing the originals, evading RLIMIT_NOFILE and causing unbounded memory allocation in the kernel's garbage collector (net/unix/af_unix.c and net/unix/garbage.c).

Why it matters to the business

Unprivileged local users or compromised processes can exhaust kernel memory on affected Linux systems, resulting in denial of service, degraded performance, or system instability that disrupts workloads and requires manual intervention or reboot.

How an attack unfolds

An attacker with local shell or code execution on an unpatched Linux host creates a UNIX socket pair, repeatedly sends open file descriptors across it, and retains the originals, triggering the kernel to allocate additional socket and file structures until memory pressure forces OOM or hangs services. Named threat actors associated with Linux kernel issues have been observed targeting similar local privilege and resource abuse vectors.

How to fix it

Upgrade the Linux kernel to version 4.4.1 or later on all affected distributions including Oracle Linux; apply vendor backports where available; consider runtime limits via cgroups or seccomp to restrict socket usage pending patching.

How to confirm the fix worked

Verify kernel version is 4.4.1 or newer with uname -r; confirm the fix commit appears in the running kernel source or package changelog; test by attempting to reproduce the descriptor-passing loop under memory accounting tools such as slabtop or /proc/meminfo.

Typical attack path

1. Obtain local execution via user account, container escape, or initial foothold
2. Open a UNIX domain socket pair
3. Create and duplicate large numbers of file descriptors
4. Transmit each descriptor over the socket while keeping the source open
5. Repeat until kernel memory consumption triggers DoS

How to detect it

Review system logs for repeated UNIX socket activity from untrusted processes, monitor kernel memory usage spikes correlated with specific PIDs, and examine auditd or eBPF traces for excessive sendmsg or socketpair calls; correlate with threat actor TTPs involving Linux kernel resource abuse.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant Linux hosts within the next maintenance window
• Audit local user accounts and containers for unnecessary file-descriptor or socket privileges
• Enable kernel memory accounting and OOM killer logging for early detection of resource exhaustion
• Monitor EPSS and threat actor reporting for any future uptick in exploitation of similar local kernel flaws