A Netfilter kernel subsystem vulnerability has been identified (CVE-2022-1972), similar to the issue disclosed at the end of May. The new vulnerability also allows a local user to gain root privileges in the system through manipulation of nftables rules and requires access to nftables, which can be obtained in a separate namespace (network namespace or user namespace) when having CLONE_NEWUSER, CLONE_NEWNS, or CLONE_NEWNET rights (for example, when able to launch an isolated container).
The problem is caused by a bug in the code for processing set lists with fields that include multiple ranges, leading to a buffer overflow when handling specially crafted list parameters. Researchers managed to prepare a working exploit to gain root privileges in Ubuntu 21.10 with kernel 5.13.0-39-generic. The vulnerability manifests starting from kernel 5.6. A patch has been proposed for the fix. To block exploitation of the vulnerability in regular systems, ensure that the ability to create namespaces by unprivileged users is disabled ("sudo sysctl -w kernel.unprivileged_userns_clone=0").
Additionally, information has been published about three vulnerabilities in the kernel related to the NFC subsystem. The vulnerabilities allow for a crash to be triggered through actions performed by an unprivileged user (more dangerous attack vectors have not yet been demonstrated):
- CVE-2022-1734 — a use-after-free memory access in the nfcmrvl driver (drivers/nfc/nfcmrvl), manifested when simulating an NFC device in user space.
- CVE-2022-1974 — a use-after-free memory access in netlink functions for NFC devices (/net/nfc/core.c), manifested when registering a new device. Like the previous vulnerability, the problem can be exploited by simulating an NFC device in user space.
- CVE-2022-1975 — a bug in the firmware loading code for NFC devices that can be used to trigger a 'panic' state.
Forrás: opennet.ru
