Debian 12 Kernel Security Update DLA-4817-1: Privilege Escalation Detection and Patch Guide

---
title: Unprivileged User Namespace Creation Followed by Privileged Process Execution
title_fr: Creation de namespace utilisateur non privilegie suivie d'une execution privilegiee
id: 4d8f2a61-9c3e-4b7a-a5d1-2e6f8c0b1d34
status: experimental
description: Detects unshare/namespace creation by unprivileged users immediately correlated with execution of setuid or root-spawned shells, a common pattern in Linux kernel local privilege escalation exploits that abuse user namespaces to reach vulnerable kernel code paths.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4817-1-linux-6-12
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1611/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_unshare:
    Image|endswith:
      - '/unshare'
      - '/nsenter'
    CommandLine|contains:
      - '-U'
      - '--user'
      - '--map-root-user'
      - '-Umr'
  selection_uid:
    User|contains:
      - 'www-data'
      - 'nobody'
      - 'apache'
      - 'nginx'
      - 'www'
  condition: selection_unshare and selection_uid
falsepositives:
  - Container runtimes (rootless podman, buildah) - filter on parent image
  - Legitimate sandboxing tools (bubblewrap, flatpak, firejail)
  - CI/CD build systems using rootless builds
level: high
---
title: Shell Spawned by Web Service or Database Service Account
id: 8b2c4e19-7a1d-4f35-b9e6-3c5d7a2f8b41
status: experimental
description: Detects interactive shell execution under service accounts commonly used as initial access footholds (www-data, postgres, mysql, redis). Kernel privilege escalation exploits are frequently staged from these contexts after web application compromise.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4817-1-linux-6-12
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.004
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/postgres'
      - '/mysqld'
      - '/redis-server'
      - '/node'
      - '/java'
  condition: selection_shell and selection_parent
falsepositives:
  - Legitimate application maintenance scripts - baseline parent-child pairs per host
  - Monitoring agents with exec plugins
level: high
---
title: Kernel Exploit Artifact Compilation or Execution in Temp Directories
id: 2f7a9c45-1e8b-4d23-a6c9-5b3e7f1a9d28
status: experimental
description: Detects compilation of C sources or execution of newly created binaries from world-writable temporary directories (/tmp, /dev/shm, /var/tmp), the standard staging pattern for Linux kernel privilege escalation exploits delivered post-compromise.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4817-1-linux-6-12
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection_compile:
    Image|endswith:
      - '/gcc'
      - '/cc'
      - '/clang'
      - '/make'
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_exec:
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_compile or selection_exec
falsepositives:
  - Software build agents and CI runners - restrict scope to production servers
  - Package managers compiling kernel modules (dkms) - filter on parent
level: high

let Lookback = 7d;
let SuspiciousExec = Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName in~ ("gcc", "cc", "clang", "make", "unshare", "nsenter")
   or (SyslogMessage has_any ("/tmp/", "/dev/shm/", "/var/tmp/") and SyslogMessage has_any ("exec", "chmod +x", "./"))
| extend Host = Computer, StageTime = TimeGenerated, StageMsg = SyslogMessage, StageProc = ProcessName;
let ShellSpawn = Syslog
| where TimeGenerated > ago(Lookback)
| where SyslogMessage has_any ("www-data", "nobody", "postgres", "mysql", "redis")
   and SyslogMessage has_any ("/bin/bash", "/bin/sh", "/bin/dash", "python", "perl")
| extend Host = Computer, ShellTime = TimeGenerated, ShellMsg = SyslogMessage;
SuspiciousExec
| join kind=inner ShellSpawn on Host
| where ShellTime between (StageTime .. StageTime + 30m)
| project Host, StageTime, StageProc, StageMsg, ShellTime, ShellMsg
| summarize EventCount = count(), FirstSeen = min(StageTime), LastSeen = max(ShellTime) by Host, StageProc
| order by LastSeen desc;

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "unshare" or SyslogMessage has "CLONE_NEWUSER"
| where SyslogMessage !has_any ("podman", "buildah", "flatpak", "bubblewrap", "docker")
| summarize ExecutionCount = count(), DistinctUsers = dcount(Computer) by Computer, SyslogMessage
| order by ExecutionCount desc;

-- Hunt: Kernel LPE staging artifacts on Debian 12 hosts (DLA-4817-1 context)
-- Identifies executables in temp dirs and running processes from suspicious paths

LET running_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '^/(tmp|dev/shm|var/tmp)/'
   OR (Username =~ 'www-data|nobody|postgres|mysql|redis'
       AND Name =~ '^(bash|sh|dash|python|perl|unshare)$')

LET temp_artifacts = SELECT FullPath, Size, Mtime, Ctime, Mode.String AS Mode
FROM glob(globs=['/tmp/**', '/dev/shm/**', '/var/tmp/**'],
          accessor='file')
WHERE Mode.String =~ 'x'
  AND Mtime > now() - 604800
  AND NOT IsDir

SELECT * FROM running_procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'FILE_ARTIFACT' AS Name,
       FullPath AS Exe, Mode AS CommandLine, NULL AS Username,
       Mtime AS CreateTime
FROM temp_artifacts

#!/usr/bin/env bash
# DLA-4817-1 remediation and verification for Debian 12 (bookworm)
# Targets kernel 6.12.111-1~deb12u1
set -euo pipefail

REQUIRED_VERSION="6.12.111-1"
echo "[*] DLA-4817-1 kernel remediation - $(hostname) - $(date -u)"

# --- Step 1: Report current state ---
CURRENT_KERNEL=$(uname -r)
echo "[*] Running kernel: ${CURRENT_KERNEL}"
INSTALLED=$(dpkg-query -W -f='${Version}\n' 'linux-image-6.12*' 2>/dev/null | sort -V | tail -1 || echo "none")
echo "[*] Newest installed 6.12 image package version: ${INSTALLED}"

# --- Step 2: Update package lists and install fixed kernel ---
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y --only-upgrade linux-image-amd64 linux-headers-amd64 2>/dev/null || \
  apt-get install -y linux-image-6.12-amd64 linux-headers-6.12-amd64

NEW_INSTALLED=$(dpkg-query -W -f='${Version}\n' 'linux-image-6.12*' 2>/dev/null | sort -V | tail -1 || echo "none")
echo "[*] Post-update installed version: ${NEW_INSTALLED}"

if dpkg --compare-versions "${NEW_INSTALLED}" lt "${REQUIRED_VERSION}"; then
  echo "[!] WARNING: Installed kernel version (${NEW_INSTALLED}) is older than fixed version (${REQUIRED_VERSION}). Check your apt sources include bookworm-security."
  grep -rhE '^deb ' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | grep -i security || echo "[!] No security repo found in apt sources!"
  exit 2
fi
echo "[+] Fixed kernel package installed."

# --- Step 3: Compensating controls effective immediately (pre-reboot) ---
# Restrict unprivileged user namespaces - blocks the most common LPE primitive
cat > /etc/sysctl.d/99-dla4817-hardening.conf <<'EOF'
# DLA-4817-1 compensating hardening (remove after patched kernel is running and validated)
kernel.unprivileged_userns_clone = 0
# Block unprivileged eBPF - common kernel exploit vector
kernel.unprivileged_bpf_disabled = 1
# Restrict dmesg / kernel pointer leaks (info-leak mitigation)
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
# Harden against ptrace-based post-exploitation
kernel.yama.ptrace_scope = 1
EOF
sysctl --system >/dev/null
echo "[+] Compensating sysctl hardening applied (userns, eBPF, kptr, dmesg, ptrace)."

# --- Step 4: Detect reboot requirement ---
if [ -f /var/run/reboot-required ]; then
  echo "[!] REBOOT REQUIRED to activate patched kernel. Pending: $(cat /var/run/reboot-required.pkgs 2>/dev/null | tr '\n' ' ')"
fi

# --- Step 5: Quick compromise check for exploit staging artifacts ---
echo "[*] Scanning temp directories for executable artifacts (last 7 days)..."
find /tmp /dev/shm /var/tmp -type f -executable -mtime -7 2>/dev/null | head -50 || echo "[+] No suspicious executables found."

echo "[*] Done. Schedule reboot during next maintenance window. Post-reboot verify with: uname -r (expect 6.12.111 or later)."