{"id":100767,"date":"2021-07-15T16:22:45","date_gmt":"2021-07-15T14:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-yadra-linux-netfilter"},"modified":"2021-07-15T16:22:45","modified_gmt":"2021-07-15T14:22:45","slug":"uyazvimost-v-podsisteme-yadra-linux-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-podsisteme-yadra-linux-netfilter","title":{"rendered":"Vulnerability in the Linux Netfilter Kernel Subsystem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2021-22555) has been identified in Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, allowing a local user to gain root privileges on the system, even within an isolated container. A working prototype exploit has been prepared for testing, bypassing the KASLR, SMAP, and SMEP protection mechanisms. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass container isolation in the kCTF cluster. <\/p>\n
The issue has been present since kernel 2.6.19, released 15 years ago, and is caused by a flaw in the IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE handlers, leading to a buffer overflow when sending specially crafted parameters via the setsockopt call in compat mode. Under normal circumstances, the compat_setsockopt() call can only be executed by the root user, but the permissions needed to carry out an attack can also be gained by a non-privileged user on systems with user namespace support enabled. <\/p>\n
A user can create a container with a separate root user and exploit a vulnerability from it. For example, 'user namespaces' is enabled by default in Ubuntu and Fedora but is not activated in Debian and RHEL. A patch to fix the vulnerability was included in the Linux kernel on April 13. Package updates have already been prepared by the Debian, Arch Linux, and Fedora projects. In Ubuntu, RHEL, and SUSE, updates are currently in preparation. <\/p>\n
The issue arises in the xt_compat_target_from_user() function due to an incorrect calculation of the memory size when saving kernel structures after converting from 32-bit to 64-bit representation. The error allows four zeros to be written to any position outside the allocated buffer, limited by the offset 0x4C. This opportunity was sufficient to create an exploit that would obtain root privileges \u2014 by clearing the m_list->next pointer in the msg_msg structure, it created conditions for accessing data after memory has been freed (use-after-free), which was then used to obtain address information and manipulate other structures through the msgsnd() system call. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"