{"id":103645,"date":"2022-03-29T15:37:18","date_gmt":"2022-03-29T13:37:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec"},"modified":"2022-03-29T15:37:18","modified_gmt":"2022-03-29T13:37:19","slug":"v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","title":{"rendered":"Exploitable vulnerabilities have been identified in nf_tables, watch_queue, and IPsec in the Linux kernel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Several dangerous vulnerabilities have been found in the Linux kernel, allowing a local user to escalate their privileges in the system. Working prototypes of exploits have been prepared for all the issues considered. <\/p>\n
\n
A vulnerability (CVE-2022-0995) in the event tracking subsystem watch_queue leads to data being written into kernel memory areas beyond the allocated buffer. An attack can be executed by any unprivileged user and result in the execution of their own code with kernel privileges. The vulnerability exists in the watch_queue_set_size() function and is related to an attempt to clear all pointers in the list, even if memory has not been allocated for them. The issue manifests when the kernel is built with the 'CONFIG_WATCH_QUEUE=y' option, which is used in most Linux distributions.\n
The vulnerability has been fixed in a change added to the kernel on March 11. Updates on package publication in distributions can be tracked on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A public prototype of the exploit is already available and allows for root access when run on Ubuntu 21.10 with kernel 5.13.0-37.
<\/center> <\/p>\n
The vulnerability (CVE-2022-27666) in the esp4 and esp6 kernel modules implementing ESP transformations (Encapsulating Security Payload) for IPsec, used for IPv4 and IPv6. The vulnerability allows a local user with normal privileges to overwrite objects in kernel memory and escalate their privileges in the system. The issue is caused by a lack of verification of the allocated memory size against the actual received data, as the maximum message size could exceed the maximum memory size allocated for the skb_page_frag_refill structure.\n
The vulnerability was resolved in the kernel on March 7 (fixed in 5.17, 5.16.15, etc.). Updates on package releases in distributions can be tracked on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A working prototype of the exploit, allowing a regular user to gain root access on Ubuntu Desktop 21.10 in the default configuration, has already been posted on GitHub. It is claimed that with minor modifications, the exploit will also work in Fedora and Debian. Notably, the exploit was originally prepared for the pwn2own 2022 competition, but kernel developers identified and fixed the associated bug, so it was decided to disclose the vulnerability details.
![\"Exploitable](\"\/wp-content\/uploads\/2022\/03\/9cdfd5bdf66d257757d1a4c600b96249.jpg\")
<\/center> <\/p>\n