Debian DSA-6477-1 Linux Kernel Security Update: Detection and Remediation Guide for SOC Teams

---
title: Linux User Namespace Creation with Root Mapping
id: 3f8a1c24-7b2e-4d91-a6f5-9c0e2b4d7a11
status: experimental
description: Detects unshare invocations that create a user namespace with root mapping. This is the canonical first step in Linux kernel local privilege escalation exploits (nf_tables, io_uring, and similar) because it grants namespace-scoped capabilities that expose privileged kernel attack surface to unprivileged users.
references:
  - https://security-tracker.debian.org/tracker/DSA-6477-1
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/unshare'
  selection_flags:
    CommandLine|contains:
      - '--user'
      - ' -U '
  selection_map:
    CommandLine|contains:
      - '--map-root-user'
      - '--map-auto'
  filter_containers:
    ParentImage|endswith:
      - '/podman'
      - '/dockerd'
      - '/containerd'
      - '/buildah'
      - '/flatpak'
  condition: selection_img and selection_flags and selection_map and not filter_containers
falsepositives:
  - Rootless container tooling (podman, buildah) executed directly by developers
  - Sandbox-aware applications such as Flatpak and Chromium-based browsers
level: high
---
title: Kernel Module Loaded from Temporary or World-Writable Path
id: 8c2d5f17-3a94-4e68-b1c2-5d7e9a0f3b46
status: experimental
description: Detects insmod or modprobe loading kernel modules from temporary, world-writable, or user-controlled directories. Legitimate module loads originate from /lib/modules; loads from /tmp, /dev/shm, or /var/tmp are strongly associated with rootkit installation following kernel exploitation.
references:
  - https://security-tracker.debian.org/tracker/DSA-6477-1
  - https://attack.mitre.org/techniques/T1547.006/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1547.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/home/'
  condition: selection_img and selection_path
falsepositives:
  - Out-of-tree driver compilation and testing by system administrators (DKMS workflows build in /var/lib/dkms but load from /lib/modules)
level: critical
---
title: Modification of Kernel core_pattern for Command Execution
id: 5e1b9c83-2f47-4a58-9d36-1a7c4e8f2b09
status: experimental
description: Detects writes to /proc/sys/kernel/core_pattern, a known post-exploitation technique where attackers set a pipe handler so that any crashing process executes an attacker-controlled command as root. Frequently observed after kernel-level compromise for persistence and privilege re-entry.
references:
  - https://security-tracker.debian.org/tracker/DSA-6477-1
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains: '/proc/sys/kernel/core_pattern'
  selection_write:
    CommandLine|contains:
      - 'echo '
      - 'tee '
      - ' >'
      - 'dd '
  condition: selection and selection_write
falsepositives:
  - Legitimate crash-handling configuration by orchestration or APM tooling (rare; verify against change records)
level: high

// Hunt 1: User namespace creation with root mapping across the Debian fleet
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "unshare" and SyslogMessage has_any ("--user", "map-root-user", "map-auto")
| where SyslogMessage !has_any ("podman", "flatpak", "buildah")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Kernel module loads from suspicious paths
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("insmod", "modprobe")
| where SyslogMessage has_any ("/tmp/", "/dev/shm/", "/var/tmp/", "/home/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Fleet inventory — identify hosts still running pre-patch kernels
// Compare running kernel (from syslog banner or heartbeat) against the fixed
// version listed in DSA-6477-1 for your release. Populate FixedVersion from
// https://security-tracker.debian.org/tracker/DSA-6477-1
let FixedVersion = "<FIXED-KERNEL-VERSION-FROM-ADVISORY>";
DeviceInfo
| where OSPlatform =~ "Linux"
| summarize arg_max(Timestamp, *) by DeviceName
| project DeviceName, OSVersion, OSBuild, LastSeen
| order by DeviceName asc;

// Hunt 4 (Defender for Endpoint onboarded): namespace + module-load behavior via process events
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("unshare", "insmod", "modprobe")
| where ProcessCommandLine has_any ("map-root-user", "--user", "/tmp/", "/dev/shm/", "/var/tmp/")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- Artifact: Debian.Kernel.ExploitPrimitiveHunt
-- Purpose: Identify running processes using kernel exploitation primitives
-- and report the live kernel version for DSA-6477-1 patch verification.

-- Part 1: Processes matching LPE / rootkit installation behavior
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(unshare.*(map-root-user|map-auto|--user))'
   OR (Name =~ '(?i)insmod|modprobe' AND CommandLine =~ '(?i)/tmp/|/dev/shm/|/var/tmp/|/home/')

-- Part 2: Report the running kernel version for patch-gap analysis
-- (compare against the fixed version in https://security-tracker.debian.org/tracker/DSA-6477-1)
SELECT read_file(filename='/proc/version') AS RunningKernel,
       read_file(filename='/etc/debian_version') AS DebianRelease
FROM scope()

-- Part 3: Recently loaded kernel modules not from the standard tree
SELECT Pid, Name, CommandLine, Username
FROM pslist()
WHERE Name =~ '(?i)insmod|modprobe'
  AND CommandLine !~ '(?i)/lib/modules'

#!/usr/bin/env bash
# DSA-6477-1 remediation + verification — Debian stable/oldstable
# Reference: https://security-tracker.debian.org/tracker/DSA-6477-1
set -euo pipefail

# 1. Confirm this host is a supported Debian release
echo "[+] Debian release: $(cat /etc/debian_version)"
echo "[+] Running kernel: $(uname -r)"

# 2. Pull the security update
apt-get update
apt-get install -y --only-upgrade linux-image-$(uname -r) 2>/dev/null || \
  apt-get install -y linux-image-amd64   # adjust metapackage for your arch (arm64 etc.)

# 3. Show the newest installed kernel package — compare the version string
#    against the fixed version listed in the DSA-6477-1 tracker page
echo "[+] Installed kernel packages:"
dpkg -l 'linux-image*' | awk '/^ii/{print $2, $3}'

# 4. Identify whether a reboot is required (kernel loaded != kernel installed)
if command -v needrestart >/dev/null 2>&1; then
  needrestart -k -r a || true
else
  RUNNING="$(uname -r)"
  NEWEST="$(ls -1 /boot/vmlinuz-* | sed 's|/boot/vmlinuz-||' | sort -V | tail -1)"
  if [ "$RUNNING" != "$NEWEST" ]; then
    echo "[!] REBOOT REQUIRED: running $RUNNING, installed $NEWEST"
  else
    echo "[+] Running kernel matches newest installed kernel."
  fi
fi

# 5. COMPENSATING CONTROL (pre-reboot window): disable unprivileged user
#    namespaces to strip kernel LPE exploits of their most common entry point.
#    WARNING: breaks rootless podman/flatpak on this host — assess first.
cat > /etc/sysctl.d/90-dsa6477-hardening.conf <<'EOF'
kernel.unprivileged_userns_clone = 0
EOF
sysctl --system

# 6. Audit coverage going forward — log namespace creation and module loads
if command -v auditctl >/dev/null 2>&1; then
  auditctl -a always,exit -F arch=b64 -S unshare -S setns -k kernel_lpe_primitive || true
  auditctl -a always,exit -F arch=b64 -S init_module -S finit_module -k module_load || true
  echo "[+] auditd rules loaded (persist them in /etc/audit/rules.d/)"
fi

echo "[+] Done. Schedule the reboot, then re-verify: uname -r"