GitHub security researcher Kevin Backhouse has submitted a proof-of-concept exploit for a critical double-free memory corruption bug in GNOME’s AccountsService component, that could allow an attacker to compromise systems running the Linux operating system Ubuntu, escalating their local privileges to root. AccountsService is described as a D-Bus service that helps query and modify data associated with the user accounts stored in a system. Specifically, the flawed AccountsService improperly handles memory during certain language settings, and this is what the attacker abuses to escalate their local privileges. The vulnerability, tracked as CVE-2021-3939, can be exploited by sending curated commands as an administrator to crash services or execute programs. Although it is a very slow and inconsistent process, Backhouse states that the exploit can be run as many times as needed until the system has been successfully compromised. This vulnerability has been patched by Canonical, and users are urged to update their Ubuntu AccountsService to versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, or 0.6.55-0ubuntu14.1. The Ankura CTAPT will continue to provide actionable intelligence on the latest most critical vulnerabilities.