Several dangerous vulnerabilities have been found in the Linux kernel, allowing a local user to escalate their privileges in the system. Working prototypes of exploits have been prepared for all the issues considered.
- The vulnerability (CVE-2022-0995) in the watch_queue event tracking subsystem leads to writing data in kernel memory areas beyond the allocated buffer. An attack can be carried out by any unprivileged user and may result in running their code with kernel privileges. The vulnerability exists in the function watch_queue_set_size() and is related to attempting to clear all pointers in the list, even when memory has not been allocated for them. The issue manifests when building the kernel with the 'CONFIG_WATCH_QUEUE=y' option, which is used in most Linux distributions.
The vulnerability has been fixed in a change added to the kernel on March 11. Updates on package publication in distributions can be tracked on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A public prototype of the exploit is already available and allows for root access when run on Ubuntu 21.10 with kernel 5.13.0-37.
- The vulnerability (CVE-2022-27666) in the esp4 and esp6 kernel modules implementing ESP transformations (Encapsulating Security Payload) for IPsec, used for IPv4 and IPv6. The vulnerability allows a local user with normal privileges to overwrite objects in kernel memory and escalate their privileges in the system. The issue is caused by a lack of verification of the allocated memory size against the actual received data, as the maximum message size could exceed the maximum memory size allocated for the skb_page_frag_refill structure.
The vulnerability was resolved in the kernel on March 7 (fixed in 5.17, 5.16.15, etc.). Updates on package releases in distributions can be tracked on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A working prototype of the exploit, allowing a regular user to gain root access on Ubuntu Desktop 21.10 in the default configuration, has already been posted on GitHub. It is claimed that with minor modifications, the exploit will also work in Fedora and Debian. Notably, the exploit was originally prepared for the pwn2own 2022 competition, but kernel developers identified and fixed the associated bug, so it was decided to disclose the vulnerability details.
- Two vulnerabilities (CVE-2022-1015, CVE-2022-1016) in the netfilter subsystem in the nf_tables module, which facilitates the functioning of the nftables packet filter. The first issue allows a local unprivileged user to achieve a write beyond the allocated buffer in the stack. The overflow occurs when processing specially crafted nftables expressions, which are handled during the verification of user-defined indices that have access to nftables rules.
The vulnerability arises from the developers assuming that the value of 'enum nft_registers reg' is one byte, whereas when certain optimizations are enabled, the compiler can use a 32-bit value for it according to the C89 specification. Due to this peculiarity, the size used for checking and allocating memory does not match the actual size of the data in the structure, leading to the structure's tail overlapping with stack pointers.
The issue can be exploited to execute one's code at the kernel level, but successful exploitation requires access to nftables, which can be obtained in a separate network namespace with CLONE_NEWUSER or CLONE_NEWNET privileges (for example, when running an isolated container). The vulnerability is also closely related to the optimizations applied by the compiler, which are enabled when building with 'CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y'. Exploitation of the vulnerability is possible starting from Linux kernel 5.12.
The second vulnerability in netfilter is caused by accessing a freed memory area (use-after-free) in the nft_do_chain handler and can lead to leaking uninitialized areas of kernel memory, which can be read through nftables expression manipulations, and can be used, for example, to determine pointer addresses when developing exploits for other vulnerabilities. The exploitation of this vulnerability is possible starting from Linux kernel 5.13.
The vulnerabilities have been fixed in today's patch updates for kernel versions 5.17.1, 5.16.18, 5.15.32, 5.10.109, 5.4.188, 4.19.237, 4.14.274, and 4.9.309. You can track package update releases in distributions on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. The researcher who identified the issues has announced the preparation of working exploits for both vulnerabilities, which are planned to be published in a few days after the distributions release updates with the kernel.
Source: opennet.ru
