CVE-2013-7446

What it actually does

Use-after-free condition in net/unix/af_unix.c triggered by crafted epoll_ctl calls on AF_UNIX sockets, allowing local permission bypass or kernel panic.

Why it matters to the business

Local attackers on unpatched Linux systems can cause service disruption through kernel panics or bypass intended socket access controls, though the issue is old with low exploitation probability and no known ransomware usage.

How an attack unfolds

An attacker with local access crafts sequences of epoll_ctl calls against AF_UNIX sockets to trigger the use-after-free, either to bypass permission checks or induce a denial-of-service panic; public exploits exist but real-world campaigns remain limited.

How to fix it

Upgrade the Linux kernel to version 4.3.3 or later; apply vendor backports if running supported enterprise distributions; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is 4.3.3 or newer; recompile test programs that exercise epoll_ctl on AF_UNIX sockets and confirm no crash or permission bypass occurs.

Typical attack path

1. Obtain local shell or process execution on target Linux host
2. Identify or create AF_UNIX sockets
3. Issue crafted epoll_ctl sequences to trigger use-after-free
4. Either observe permission bypass or trigger kernel panic for DoS

How to detect it

Review kernel logs for oops or panic entries referencing af_unix or epoll; look for processes making repeated epoll_ctl calls on UNIX sockets immediately before crashes.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-tenant Linux systems
• Enable kernel hardening features such as SMEP/SMAP and lock down unprivileged user namespaces where possible
• Monitor for unusual AF_UNIX socket activity in high-value environments