{"id":107817,"date":"2023-04-12T18:48:17","date_gmt":"2023-04-12T16:48:17","guid":{"rendered":"https:\/\/prohoster.info\/?p=107817"},"modified":"2023-04-13T08:25:12","modified_gmt":"2023-04-13T06:25:12","slug":"uyazvimosti-v-qos-podsisteme-yadra-linux-pozvolyayushhie-podnyat-svoi-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-qos-podsisteme-yadra-linux-pozvolyayushhie-podnyat-svoi-privilegii-v-sisteme","title":{"rendered":"Vulnerabilities in the Linux kernel's QoS subsystem allowing privilege elevation in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been identified in the Linux kernel, allowing a local user to escalate their privileges in the system. To exploit these vulnerabilities, permission to create and modify traffic classifiers is required, which is available with CAP_NET_ADMIN rights that can be obtained if user namespace creation is possible. The issues manifest starting from kernel version 4.14 and have been fixed in branch 6.2. <\/p>\n
The vulnerabilities are caused by memory access after it has been freed (use-after-free) in the traffic classification code tcindex, part of the Linux kernel's QoS (Quality of Service) subsystem. The first vulnerability manifests due to a race condition when updating suboptimal hash filters, while the second vulnerabilities occur during the removal of an optimal hash filter. You can track the fixes in the distributions on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch. To block the exploitation of the vulnerability through a workaround, you can disable the creation of user namespaces by unprivileged users (\"sudo sysctl -w kernel.unprivileged_userns_clone=0\"). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"