A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, has been found to have a vulnerability (CVE not assigned) that allows a local user to execute code at the kernel level and elevate their privileges in the system. Researchers demonstrated an exploit that enabled a local user to gain root rights on Ubuntu 22.04 with kernel 5.15.0-39-generic. Initially, the information about the vulnerability was scheduled to be published on August 15, but due to the copying of a letter with the exploit prototype to a public mailing list, the embargo on disclosure was lifted.
The problem manifests starting from kernel version 5.8 and is caused by a buffer overflow in the code for processing set lists in the nf_tables module, which occurred due to inadequate checks in the nft_set_elem_init function. The error was introduced in the change that expanded the storage area for list items to 128 bytes.
An attack requires access to nftables, which can be obtained in a separate network namespace with CLONE_NEWUSER, CLONE_NEWNS or CLONE_NEWNET rights (for example, if you can run an isolated container). A fix is not yet available. To block the exploitation of the vulnerability in ordinary systems, ensure that the creation of namespaces by unprivileged users is disabled ("sudo sysctl -w kernel.unprivileged_userns_clone=0").
Forrás: opennet.ru
