A vulnerability (CVE-2022-0435) has been identified in the Linux kernel module that enables the operation of the TIPC (Transparent Inter-process Communication) network protocol, potentially allowing code execution at the kernel level via the sending of specially crafted network packets. The issue only affects systems with the tipc.ko kernel module loaded and a configured TIPC stack, which is typically used in clusters and is not enabled by default in non-specialized Linux distributions.
It is noted that when the kernel is built with the "CONFIG_FORTIFY_SRC=y" option (used in RHEL), which adds additional boundary checks to the memcpy() function, exploitation is limited to crashing the system (the kernel enters a panic state). When run without additional checks and with leaked information about the canary values used for stack protection, the issue could be exploited for remote code execution with kernel privileges. Researchers who discovered this vulnerability state that the exploitation technique is trivial and will be disclosed after widespread mitigation of the vulnerability in distributions.
The vulnerability is caused by a stack overflow that occurs when processing packets where the participant node count field's value exceeds 64. domainTo store node parameters in the tipc.ko module, a fixed array “u32 members[64]” is used, but during the processing of the specified node number in the packet, no check is performed on the value of “member_cnt”, allowing values greater than 64 to be used for controlled overwriting of data in the memory area following the “dom_bef” structure on the stack.
The bug leading to the vulnerability was introduced on June 15, 2016, and was included in the Linux kernel 4.8. The vulnerability has been fixed in Linux kernel releases 5.16.9, 5.15.23, 5.10.100, 5.4.179, 4.19.229, 4.14.266, and 4.9.301. The issue remains unpatched in the kernels of most distributions: RHEL, Debian, Ubuntu, SUSE, Fedora, Gentoo, Arch Linux.
The TIPC protocol was originally developed by Ericsson and is intended for inter-process communication within a cluster, mainly activated on cluster nodes. TIPC can operate over both Ethernet and UDP (network port 6118). When working over Ethernet, an attack can be conducted from the local network, while using UDP allows for attacks from the global network if the port is not protected by a firewall. An attack may also be performed by an unprivileged local user on the host. To activate TIPC, the tipc.ko kernel module must be loaded, and it should be bound to the network interface using netlink or the tipc utility.
Source: opennet.ru
