Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path

The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock…

Description

The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock class privilege escalation exploits. When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module. In vulnerable kernels, this triggers a stale IOTLB metadata cache access path that allows an unprivileged user to write an arbitrary value to modprobe_path. The specific address family number varies by kernel and exploit variant (AF 41, 42, or any unregistered AF).

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_syscall

Known benign triggers

  • Legitimate processes almost never open a SOCK_RAW socket with an unregistered address family. The EAFNOSUPPORT error on a raw socket from a non-system path has no benign use case outside of socket fuzzing or explicit error-handling tests

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice