A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, has a vulnerability (CVE-2021-22555) that allows a local user to gain root privileges in the system, even when in an isolated container. A working prototype of an exploit, bypassing the KASLR, SMAP, and SMEP protection mechanisms, has been prepared for testing. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass Kubernetes container isolation in the kCTF cluster.
The issue has been present since kernel 2.6.19, released 15 years ago, and is caused by a bug in the IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE handlers that leads to a buffer overflow when sending specially formatted parameters via the setsockopt call in compat mode. Under normal conditions, the compat_setsockopt() call can only be executed by the root user, but the necessary privileges for carrying out the attack can also be obtained by unprivileged users in systems with user namespaces support enabled.
A user can create a container with a separate root user and exploit the vulnerability from it. For example, "user namespaces" is enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL. A patch fixing the vulnerability was incorporated into the Linux kernel on April 13. Package updates have already been prepared by the Debian, Arch Linux, and Fedora projects. In Ubuntu, RHEL, and SUSE, updates are in the preparation stage.
The problem arises in the function xt_compat_target_from_user() due to an incorrect calculation of memory size when saving kernel structures after converting from 32-bit to 64-bit representation. The error allows writing four zero bytes to any position outside the allocated buffer, limited by an offset of 0x4C. This capability was sufficient to create an exploit that achieves root privileges — by clearing the pointer m_list->next in the msg_msg structure, conditions were created for accessing data after memory has been freed (use-after-free), which was then used to obtain address information and modify other structures through manipulation with the msgsnd() system call.
Forrás: opennet.ru
