A Linux kernel module that supports the TIPC (Transparent Inter-process Communication) network protocol has a vulnerability (CVE-2022-0435) that potentially allows arbitrary code execution at the kernel level via specially crafted network packets. The issue affects only systems with the loaded kernel module tipc.ko and a configured TIPC stack, which is typically used in clusters and is not enabled by default in general-purpose Linux distributions.
It has been noted that when compiling the kernel with the option 'CONFIG_FORTIFY_SRC=y' (used in RHEL), which adds additional boundary checks to the memcpy() function, exploitation is limited to crashing the kernel (causing it to enter a panic state). When executed without these additional checks and if information about the canary values used to protect the stack leaks, the issue could be exploited for remote code execution with kernel privileges. Researchers who discovered the issue state that the exploitation technique is trivial and will be disclosed after the vulnerability is widely patched in distributions.
The vulnerability is caused by a stack overflow occurring when processing packets, where the value of the field containing the number of participant nodes exceeds 64. To store the node parameters in the tipc.ko module, a fixed array 'u32 members[64]' is used, but during the processing of the specified node number in the packet, there is no validation of the 'member_cnt' value, which allows the use of values greater than 64 for controlled overwriting of data in memory adjacent to the 'dom_bef' structure on the stack. domainThe error leading to the vulnerability was introduced on June 15, 2016, and became part of the Linux kernel 4.8. The vulnerability has been fixed in releases of the Linux kernel 5.16.9, 5.15.23, 5.10.100, 5.4.179, 4.19.229, 4.14.266, and 4.9.301. In the kernels of most distributions, the issue remains unpatched: RHEL, Debian, Ubuntu, SUSE, Fedora, Gentoo, Arch Linux.
A vulnerability in the Linux kernel, associated with the TIPC (Transparent Inter-process Communication) network protocol, has been identified (CVE-2022-0435), which potentially allows for arbitrary code execution at the kernel level through.
The TIPC protocol was originally developed by Ericsson, intended for inter-process communication within a cluster and is primarily activated on cluster nodes. TIPC can operate over Ethernet as well as over UDP (network port 6118). In the case of operation over Ethernet, an attack can be carried out from the local network, while using UDP — from the global network if the port is not closed by a firewall. An attack can also be executed by an unprivileged local user of the host. To activate TIPC, loading the kernel module tipc.ko and configuring the binding to the network interface using netlink or the tipc utility is necessary.
Forrás: opennet.ru
