A vulnerability has been identified in the Netfilter kernel subsystem (CVE-2022-1972), similar to an issue disclosed at the end of May. This new vulnerability also allows a local user to gain root privileges in the system through manipulation of nftables rules and requires access to nftables, which can be obtained in a separate namespace (network namespace or user namespace) with CLONE_NEWUSER, CLONE_NEWNS, or CLONE_NEWNET rights (for example, when it is possible to run an isolated container).
The issue is caused by a coding error in processing set lists with fields that include multiple ranges, leading to a buffer overflow when handling specially crafted list parameters. Researchers have prepared a working exploit to gain root privileges in Ubuntu 21.10 with kernel 5.13.0-39-generic. The vulnerability manifests starting from kernel 5.6. A fix has been proposed in the form of a patch. To block exploitation of the vulnerability in general systems, ensure that the creation of namespaces by unprivileged users is disabled ("sudo sysctl -w kernel.unprivileged_userns_clone=0").
Additionally, information has been released about three vulnerabilities in the kernel related to the NFC subsystem. These vulnerabilities allow a crash to be triggered by an unprivileged user (more dangerous attack vectors have not yet been demonstrated):
- CVE-2022-1734 — a use-after-free issue in the nfcmrvl driver (drivers/nfc/nfcmrvl), manifested during the simulation of an NFC device in user space.
- CVE-2022-1974 — a use-after-free issue in netlink functions for NFC devices (/net/nfc/core.c), manifested during the registration of a new device. Like the previous vulnerability, this issue can be exploited through the simulation of an NFC device in user space.
- CVE-2022-1975 — a flaw in the firmware loading code for NFC devices, which can be used to trigger a "panic" state.
Source: opennet.ru
