Three years after the wave of vulnerabilities (, , , , ) in the AF_PACKET subsystem of the Linux kernel, another issue (), allowing a local unprivileged user to execute code with root privileges or escape from isolated containers, provided they have root access within them.
To create an AF_PACKET socket and exploit the vulnerability, CAP_NET_RAW privileges are required. However, this privilege can be granted to unprivileged users in containers created within systems that have user namespace support enabled. For example, user namespaces are enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL. In Android, the process mediaserver has the right to create AF_PACKET sockets, through which the vulnerability can be exploited.
The vulnerability exists in the tpacket_rcv function and is caused by an error in the calculation of the netoff variable. An attacker can create conditions under which the netoff variable will be assigned a value less than the maclen variable, leading to an overflow when calculating "macoff = netoff - maclen" and an incorrect subsequent pointer establishment for the incoming data buffer. As a result, an attacker could initiate a write from 1 to 10 bytes into the memory area beyond the allocated buffer. It is noted that an exploit is under development that allows gaining root access in the system.
The problem has been present in the kernel since July 2008, so it manifests in all current kernels. A fix is currently available as . You can track the release of package updates in distributions on the following pages: , , , , , .
Source: opennet.ru
