A vulnerability has been discovered in Netfilter, the Linux kernel subsystem used for filtering and modifying network packets (CVE not assigned), allowing a local user to execute code at the kernel level and elevate their privileges in the system. Researchers demonstrated an exploit enabling a local user to gain root rights in Ubuntu 22.04 with kernel version 5.15.0-39-generic. The initial plan was to publish information about the vulnerability on August 15, but the embargo on the disclosure was lifted due to the copying of a letter containing the exploit prototype to a public mailing list.
The issue appears starting with kernel release 5.8 and is caused by a buffer overflow in the code handling set lists in the nf_tables module, due to a lack of proper checks in the nft_set_elem_init function. The bug was introduced in a change that expanded the storage area for list elements to 128 bytes.
To carry out the attack, access to nftables is required, which can be obtained in a separate network namespace if the user has CLONE_NEWUSER, CLONE_NEWNS, or CLONE_NEWNET rights (for example, if they are able to run an isolated container). A fix is currently not available. To block the exploitation of the vulnerability on regular systems, ensure that the creation of namespaces by unprivileged users is disabled (‘sudo sysctl -w kernel.unprivileged_userns_clone=0’).
Source: opennet.ru
