A vulnerability (CVE-2021-22555) has been identified in Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, allowing a local user to gain root privileges on the system, even within an isolated container. A working prototype exploit has been prepared for testing, bypassing the KASLR, SMAP, and SMEP protection mechanisms. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass container isolation in the kCTF cluster.
The issue has been present since kernel 2.6.19, released 15 years ago, and is caused by a flaw in the IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE handlers, leading to a buffer overflow when sending specially crafted parameters via the setsockopt call in compat mode. Under normal circumstances, the compat_setsockopt() call can only be executed by the root user, but the permissions needed to carry out an attack can also be gained by a non-privileged user on systems with user namespace support enabled.
A user can create a container with a separate root user and exploit the vulnerability from it. For example, 'user namespaces' is enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL. A patch to fix the vulnerability was integrated into the Linux kernel on April 13. Package updates have already been prepared by the Debian, Arch Linux, and Fedora projects. In Ubuntu, RHEL, and SUSE, updates are in preparation.
The problem occurs in the xt_compat_target_from_user() function due to incorrect memory size calculation when saving kernel structures after converting from a 32-bit to a 64-bit representation. The flaw allows writing four zero bytes to any position beyond the allocated buffer, limited by an offset of 0x4C. This opportunity was sufficient to create an exploit for gaining root rights—by clearing the pointer m_list->next in the msg_msg structure, conditions were created to access data after the memory has been freed (use-after-free), which was then utilized to obtain information about addresses and modify other structures through manipulation with the msgsnd() system call.
Source: opennet.ru
