A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, a vulnerability (CVE-2022-25636) has been identified that allows code execution at the kernel level. A proof of concept exploit is reported to be prepared, allowing a local user to elevate their privileges in Ubuntu 21.10 with the KASLR protection mechanism disabled. The issue manifests starting from kernel 5.4. A fix is currently available as a patch (corrective kernel releases have not been formed). You can track the publication of package updates in distributions on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux.
The vulnerability is caused by an error in computing the size of the array flow->rule->action.entries in the function nft_fwd_dup_netdev_offload (defined in the file net/netfilter/nf_dup_netdev.c), which can lead to controlled data by the attacker being written to memory outside the allocated buffer. The error occurs when setting up "dup" and "fwd" rules in chains to which hardware packet processing acceleration (offload) is applied. Since the overflow occurs before the creation of the packet filter rule and the offload support check, the vulnerability is also applicable to network devices that do not support hardware acceleration, such as loopback interfaces.
It is noted that the issue is quite easy to exploit since the out-of-bounds values can overwrite the pointer to the net_device structure, and the data about the overwritten value is returned to user space, allowing the necessary addresses for the attack to be discovered in memory. To exploit the vulnerability, specific rules in nftables need to be created, which is only possible with CAP_NET_ADMIN privileges that can be obtained by an unprivileged user in a separate network namespace. The vulnerability can also be used for attacks on container isolation systems.
Forrás: opennet.ru
