From 4427dd26bb4cf434407392908d29c471bf5d75d9 Mon Sep 17 00:00:00 2001 From: Jonathan Hurter Date: Thu, 16 Jul 2026 15:20:32 +0200 Subject: [PATCH] fix(SSB-003) Focus on CVE-2026-43499 Fix #3866 --- .../security/bulletins/2026-07-13-SSB-2026-003.md | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/src/_posts/security/bulletins/2026-07-13-SSB-2026-003.md b/src/_posts/security/bulletins/2026-07-13-SSB-2026-003.md index 64d673093..039c8d69d 100644 --- a/src/_posts/security/bulletins/2026-07-13-SSB-2026-003.md +++ b/src/_posts/security/bulletins/2026-07-13-SSB-2026-003.md @@ -10,8 +10,6 @@ cvss: environmental: 9.4 --- -⚠️ Published: 2026-07-13. Last updated: 2026-07-13. - {% note %} All timestamps are UTC+2 {% endnote %} @@ -32,8 +30,6 @@ A public PoC (IonStack chain, [NebuSec research](https://nebusec.ai/buglist/CVE- The [NebuSec research paper](https://nebusec.ai/buglist/CVE-2026-43499/) describes a full local privilege escalation to root within the container, and a more advanced variant enabling container escape and cross-tenant host compromise. Scalingo did not independently reproduce the full LPE chain; however, given the root cause (use-after-free in a core locking primitive) and the credibility of the research, we assessed the LPE scenario as plausible and treated the vulnerability accordingly. Based on our monitoring, we found no evidence that any such attack occurred on Scalingo infrastructure. -Note: two regression vulnerabilities ([CVE-2026-53166](https://nvd.nist.gov/vuln/detail/CVE-2026-53166) and [CVE-2026-53163](https://nvd.nist.gov/vuln/detail/CVE-2026-53163)) were introduced by the upstream fix. These cause kernel denial-of-service rather than privilege escalation, and no public exploit exists for them. We are actively monitoring for patches. - ## What we did Scalingo took the following actions after the public disclosure: @@ -52,10 +48,6 @@ This was a host OS migration only: your application stacks, runtimes, and depend If you observed unexpected behaviour in your application between July 9 and July 13 and suspect it may be related, please contact Scalingo support. -## What we will do in the future - -Two regression vulnerabilities in the Linux kernel fix ([CVE-2026-53166](https://nvd.nist.gov/vuln/detail/CVE-2026-53166), [CVE-2026-53163](https://nvd.nist.gov/vuln/detail/CVE-2026-53163)) are being tracked as follow-up items. We are monitoring the distribution security tracker for patch availability and will apply fixes as soon as a patched version is published. We will update this bulletin when those patches are deployed. - ## Product Impacts ### Scalingo PaaS @@ -84,7 +76,6 @@ If you have any questions or concerns regarding this bulletin, please contact Sc | 2026-07-08 11:05 | Determined that no reliable mitigation was available on the affected host OS release. Decision made to accelerate migration to the patched LTS release, which had already been planned. | | 2026-07-08 15:00 | New account signups suspended outside office hours as a precautionary measure. Active monitoring started. | | 2026-07-08 16:15 | Confirmed that the patched kernel version on the target release fixes [CVE-2026-43499](https://nvd.nist.gov/vuln/detail/CVE-2026-43499). | -| 2026-07-08 22:00 | Two regression CVEs identified: [CVE-2026-53166](https://nvd.nist.gov/vuln/detail/CVE-2026-53166) and [CVE-2026-53163](https://nvd.nist.gov/vuln/detail/CVE-2026-53163). No public exploit is known. | | 2026-07-09 12:00 | QA testing for the emergency migration completed successfully. | | 2026-07-09 18:55 | Production rollout of application nodes started. | | 2026-07-09 22:15 | Rollout completed for region `osc-secnum-fr1`. | @@ -95,5 +86,6 @@ If you have any questions or concerns regarding this bulletin, please contact Sc ## Changelog +- 2026-07-16: Focus the SSB on the CVE-2026-43499 - 2026-07-13: Initial publication.