A vulnerability (CVE-2022-0185) has been identified in the API Filesystem Context provided by the Linux kernel, allowing a local user to gain root privileges on the system. The researcher who disclosed the issue published a demonstration of an exploit that can execute code with root privileges on the default configuration of Ubuntu 20.04. The exploit code is set to be hosted on GitHub within a week after the distributions release an update to fix the vulnerability.
The vulnerability exists in the legacy_parse_param() function in VFS and is caused by the lack of proper checks on the maximum size of parameters provided in filesystems that do not support the API Filesystem Context. Passing too large a parameter can cause an integer overflow in the variable used to calculate the size of the data being written — there is a check in the code to prevent buffer overflow "if (len > PAGE_SIZE - 2 - size)" that fails if the size value is greater than 4094 due to integer underflow (when converting 4096 - 2 - 4095 to unsigned int, it results in 2147483648).
This error allows accessing a specially crafted filesystem image to cause a buffer overflow and overwrite kernel data that follows the allocated memory region. Exploiting the vulnerability requires CAP_SYS_ADMIN privileges, i.e., administrative rights. The issue is that an unprivileged user can gain such privileges in an isolated container if user namespace support is enabled in the system. For example, user namespaces are enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL (unless container isolation platforms are used).
The issue manifests from Linux kernel 5.1 and was fixed in yesterday's updates 5.16.2, 5.15.16, 5.10.93, and 5.4.173. Update packages with the vulnerability fix have already been released for RHEL, Debian, Fedora, and Ubuntu. A fix is still unavailable in Arch Linux, Gentoo, SUSE, and openSUSE. As a workaround protection for systems not using container isolation, the sysctl "user.max_user_namespaces" can be set to 0: echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf
Source: opennet.ru
