Debian DSA-6477-1: Linux Kernel 6.12.107-1 Fixes Privilege Escalation Flaws in Trixie — Patching and Detection Guide

# Check the running kernel and installed kernel package version
uname -r
dpkg -l | grep linux-image

# Compare against the fixed release — anything below 6.12.107-1 on Trixie is vulnerable
apt-cache policy linux-image-amd64

---
title: Unprivileged User Spawning Root Shell or Privilege Escalation Artifacts
id: 3f8a2c14-7b61-4e59-a2d3-9c1e5f7a8b02
status: experimental
description: Detects common post-exploitation patterns following a local privilege escalation on Linux, such as unprivileged service accounts spawning interactive shells, su/sudo abuse, or execution of binaries from world-writable paths consistent with compiled kernel LPE exploits.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6477-1-linux
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1548/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection_service_shell:
    User|contains:
      - 'www-data'
      - 'wwwrun'
      - 'apache'
      - 'nginx'
      - 'nobody'
      - 'daemon'
      - 'tomcat'
      - 'jenkins'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
  selection_tmp_exec:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: 1 of selection_*
falsepositives:
  - Legitimate application drop scripts or CI jobs running from temporary directories
  - Admin maintenance shells on service accounts
level: high
---
title: Kernel Module Loaded Outside Package Management
id: 8c4d1e72-3a95-4b08-b6f1-2d7e9a0c5f43
status: experimental
description: Detects insertion of kernel modules via insmod/modprobe executed outside of legitimate package installation or boot processes. Loadable kernel module rootkits are a common persistence mechanism after a successful kernel privilege escalation.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6477-1-linux
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.006
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
      - '/kmod'
  filter_pkgmgr:
    ParentImage|endswith:
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/dkms'
      - '/systemd'
  condition: selection and not 1 of filter_*
falsepositives:
  - Administrators manually loading vendor drivers or out-of-tree modules
  - DKMS rebuilds during kernel updates (filter on dkms parent where possible)
level: medium
---
title: Compiler Execution on Server Workload Indicating On-Host Exploit Build
id: 5b2e7f09-1c48-4d3a-96e7-4f0a8b6c2d15
status: experimental
description: Detects gcc/cc/clang execution by non-developer or service accounts on production servers. Kernel LPE exploits are frequently compiled directly on the target host to match the running kernel version.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6477-1-linux
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/gcc'
      - '/cc'
      - '/clang'
      - '/g++'
      - '/make'
    User|contains:
      - 'www-data'
      - 'nginx'
      - 'apache'
      - 'nobody'
      - 'daemon'
      - 'postgres'
      - 'mysql'
      - 'redis'
      - 'tomcat'
falsepositives:
  - Build servers and CI runners (scope these hosts out via asset tagging)
level: high

// Hunt: post-LPE behavior on Debian/Linux hosts — service-account shells,
// execution from world-writable paths, and unexpected kernel module loads
let ServiceAccounts = dynamic(["www-data","nginx","apache","nobody","daemon","tomcat","jenkins","postgres","mysql","redis"]);
let ShellImages = dynamic(["/bin/sh","/bin/bash","/bin/dash","/bin/zsh","/usr/bin/bash","/usr/bin/zsh"]);
let SuspiciousPaths = dynamic(["/tmp/","/dev/shm/","/var/tmp/"]);
union isfuzzy=true
  (
    Syslog
    | where TimeGenerated > ago(7d)
    | where Facility =~ "authpriv" or ProcessName in~ ("sh","bash","dash","zsh","insmod","modprobe","gcc","cc","make")
    | extend Msg = tostring(SyslogMessage)
    | where Msg has_any (SuspiciousPaths)
        or (ProcessName in~ ("insmod","modprobe") and Msg !has "dpkg")
    | project TimeGenerated, Computer, ProcessName, Msg, Source = "Syslog"
  ),
  (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where DeviceName has_any ("debian","trixie") or true  // remove device filter if fleet-wide
    | extend InitiatingUser = tostring(InitiatingProcessAccountName)
    | where
        (InitiatingUser in~ (ServiceAccounts) and FileName in~ ("sh","bash","dash","zsh"))
        or (ProcessCommandLine has_any (SuspiciousPaths) and FileName !in~ ("apt","dpkg"))
        or (FileName in~ ("insmod","modprobe") and InitiatingProcessFileName !in~ ("dpkg","apt","apt-get","dkms"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingUser, InitiatingProcessFileName, Source = "MDE"
  )
| order by TimeGenerated desc

-- Hunt: artifacts of kernel LPE post-exploitation on Debian hosts
-- 1) Executables staged in world-writable paths (typical exploit droppers)
-- 2) Recently created setuid/setgid binaries (typical post-root backdoors)
SELECT FullPath, Size, Mtime, Ctime,
       Mode.String AS Mode
FROM glob(globs=['/tmp/**','/dev/shm/**','/var/tmp/**'])
WHERE NOT IsDir
  AND (Mode.String =~ 'x')           -- any execute bit set
  AND Mtime > now() - 604800          -- written in the last 7 days
UNION ALL
SELECT FullPath, Size, Mtime, Ctime,
       Mode.String AS Mode
FROM glob(globs=['/**'])
WHERE NOT IsDir
  AND (Mode.String =~ '4[0-7]{3}' OR Mode.String =~ '2[0-7]{3}')  -- setuid/setgid
  AND FullPath !~ '^/(usr/)?(bin|sbin|lib|libexec)/'               -- exclude standard dirs
  AND Mtime > now() - 604800

#!/usr/bin/env bash
# DSA-6477-1 verification and remediation for Debian 13 (Trixie)
# Run as root. Verifies codename, applies the kernel update, and confirms the fix.
set -euo pipefail

FIXED_VERSION="6.12.107-1"

# 1) Confirm this is a Trixie system
CODENAME=$(. /etc/os-release && echo "${VERSION_CODENAME:-unknown}")
if [ "$CODENAME" != "trixie" ]; then
  echo "[WARN] This host reports codename '$CODENAME' — DSA-6477-1 targets Trixie. Check your dist's tracker."
fi

# 2) Refresh package metadata and upgrade the kernel packages
apt-get update
apt-get install -y --only-upgrade linux-image-amd64 linux-headers-amd64 2>/dev/null \
  || apt-get install -y --only-upgrade 'linux-image*'

# 3) Verify installed kernel package meets or exceeds the fixed version
INSTALLED=$(dpkg-query -W -f='${Version}' linux-image-amd64 2>/dev/null || echo "0")
if dpkg --compare-versions "$INSTALLED" ge "$FIXED_VERSION"; then
  echo "[OK] Installed kernel package $INSTALLED >= $FIXED_VERSION (DSA-6477-1 remediated)"
else
  echo "[FAIL] Installed kernel package $INSTALLED is BELOW $FIXED_VERSION — investigate apt sources/pinning"
  exit 1
fi

# 4) The running kernel does not change until reboot — check if a reboot is pending
RUNNING=$(uname -r)
if [ -f /var/run/reboot-required ]; then
  echo "[ACTION REQUIRED] Reboot pending. Running kernel: $RUNNING — schedule a reboot to activate the patched kernel."
  cat /var/run/reboot-required.pkgs 2>/dev/null || true
else
  echo "[INFO] Running kernel: $RUNNING"
fi

# 5) (Optional hardening) Restrict unprivileged user namespaces — a common LPE attack surface
# Only apply if your workloads do NOT rely on rootless containers/unprivileged namespaces.
# sysctl -w kernel.unprivileged_userns_clone=0
# echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/90-disable-unpriv-userns.conf