A Filesystem Context API vulnerability has been discovered in the Linux kernel (CVE-2022-0185), allowing a local user to gain root privileges on the system. The researcher who identified the issue has published a demonstration of an exploit that enables code execution with root privileges in Ubuntu 20.04 in its default configuration. The exploit code is expected to be posted on GitHub within a week, after the distributions release an update with a fix for the vulnerability.
The vulnerability exists in the legacy_parse_param() function in VFS and is caused by insufficient validation of the maximum size of parameters provided in filesystems that do not support the Filesystem Context API. Passing an excessively large parameter can lead to an integer variable overflow used to calculate the size of data being written — there is a boundary check in the code 'if (len > PAGE_SIZE - 2 - size)' that fails if the size value exceeds 4094 due to integer underflow (when converting 4096 - 2 - 4095 to unsigned int results in 2147483648).
This flaw allows a specially crafted filesystem image to trigger a buffer overflow and overwrite kernel data following the allocated memory area. Exploitation of the vulnerability requires possession of CAP_SYS_ADMIN rights, i.e., administrative privileges. The issue is that an unprivileged user can obtain such privileges within an isolated container if user namespace support is enabled in the system. For example, user namespaces are enabled by default in Ubuntu and Fedora but are not activated in Debian and RHEL (unless container isolation platforms are used).
The issue manifests starting from Linux kernel 5.1 and has been fixed in the recent updates 5.16.2, 5.15.16, 5.10.93, 5.4.173. Package updates with the vulnerability fix have already been released for RHEL, Debian, Fedora, and Ubuntu. The fix is currently unavailable in Arch Linux, Gentoo, SUSE, and openSUSE. As a workaround for systems not utilizing container isolation, you can set the sysctl value 'user.max_user_namespaces' to 0: echo 'user.max_user_namespaces=0' > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf
Forrás: opennet.ru
