{"id":103053,"date":"2022-01-21T15:36:44","date_gmt":"2022-01-21T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-vfs-%d1%8f%d0%b4%d1%80%d0%b0-linux-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%bf%d0%be%d0%b2%d1%8b"},"modified":"2022-01-21T15:36:44","modified_gmt":"2022-01-21T13:36:44","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-vfs-%d1%8f%d0%b4%d1%80%d0%b0-linux-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%bf%d0%be%d0%b2%d1%8b","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-vfs-%d1%8f%d0%b4%d1%80%d0%b0-linux-%d0%bf%d0%be%d0%b7%d0%b2%d0%be%d0%bb%d1%8f%d1%8e%d1%89%d0%b0%d1%8f-%d0%bf%d0%be%d0%b2%d1%8b","title":{"rendered":"A vulnerability in the Linux kernel's VFS allows privilege escalation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2022-0185) has been identified in the API Filesystem Context provided by the Linux kernel, allowing a local user to gain root privileges on the system. The researcher who disclosed the issue published a demonstration of an exploit that can execute code with root privileges on the default configuration of Ubuntu 20.04. The exploit code is set to be hosted on GitHub within a week after the distributions release an update to fix the vulnerability. <\/p>\n
The vulnerability exists in the function legacy_parse_param() in VFS and is caused by the lack of proper checks on the maximum size of parameters provided in file systems that do not support the Filesystem Context API. When an excessively large parameter is passed, it can cause an overflow of the integer variable used to calculate the size of the data being written \u2014 there is a boundary check in the code — 'if (len > PAGE_SIZE — 2 — size)', which does not trigger if the value of size exceeds 4094 due to integer underflow (when casting 4096 — 2 — 4095 to unsigned int results in 2147483648). <\/p>\n
This error allows accessing a specially crafted filesystem image to cause a buffer overflow and overwrite kernel data that follows the allocated memory region. Exploiting the vulnerability requires CAP_SYS_ADMIN privileges, i.e., administrative rights. The issue is that an unprivileged user can gain such privileges in an isolated container if user namespace support is enabled in the system. For example, user namespaces are enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL (unless container isolation platforms are used). <\/p>\n
The issue manifests starting from Linux kernel 5.1 and has been fixed in yesterday's updates 5.16.2, 5.15.16, 5.10.93, 5.4.173. Package updates that address the vulnerability have already been released for RHEL, Debian, Fedora, and Ubuntu. The fix is currently not available for Arch Linux, Gentoo, SUSE, and openSUSE. As a workaround, for systems not using container isolation, you can set the sysctl 'user.max_user_namespaces' to 0: echo 'user.max_user_namespaces=0' > \/etc\/sysctl.d\/userns.conf # sysctl -p \/etc\/sysctl.d\/userns.conf \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"