A vulnerability (CVE-2022-24122) has been found in the Linux kernel's rlimit handling code across different user namespace identifiers that allows privilege escalation within the system. This issue affects kernels starting from Linux 5.14 and will be addressed in updates 5.16.5 and 5.15.19. Stable branches of Debian, Ubuntu, SUSE/openSUSE, and RHEL are not affected, but it's present in recent kernels of Fedora and Arch Linux.
The error was introduced in the change made in the summer of 2021, which transitioned the implementation of some RLIMIT counters to use the 'ucounts' structure. The created RLIMIT 'ucounts' objects continued to be used after their allocated memory was freed (use-after-free) when the associated namespace was removed, allowing an attacker to execute their code at the kernel level.
Exploitation of the vulnerability by an unprivileged user is only possible if unprivileged user namespace access is enabled on the system, which is enabled by default in Ubuntu and Fedora but not activated in Debian and RHEL. As a workaround to block the vulnerability, unprivileged access to the user namespace can be disabled: sysctl -w kernel.unprivileged_userns_clone=0
Source: opennet.ru
