{"id":103411,"date":"2022-02-22T15:37:00","date_gmt":"2022-02-22T13:37:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2022-02-22T15:37:00","modified_gmt":"2022-02-22T13:37:00","slug":"uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-podsisteme-netfilter-pozvolyayushhaya-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Sebezhet\u0151s\u00e9g a netfilter alrendszer\u00e9ben, amely lehet\u0151v\u00e9 teszi a k\u00f3d futtat\u00e1s\u00e1t a Linux kernel szintj\u00e9n.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Netfilter, a Linux kernel subsystem used for filtering and modifying network packets, a vulnerability (CVE-2022-25636) has been identified that allows code execution at the kernel level. A proof of concept exploit is reported to be prepared, allowing a local user to elevate their privileges in Ubuntu 21.10 with the KASLR protection mechanism disabled. The issue manifests starting from kernel 5.4. A fix is currently available as a patch (corrective kernel releases have not been formed). You can track the publication of package updates in distributions on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n
A sebezhet\u0151s\u00e9g a flow->rule->action.entries t\u00f6mb m\u00e9ret\u00e9nek sz\u00e1m\u00edt\u00e1si hib\u00e1j\u00e1b\u00f3l ered az nft_fwd_dup_netdev_offload f\u00fcggv\u00e9nyben (defini\u00e1lva a net\/netfilter\/nf_dup_netdev.c f\u00e1jlban), amely lehet\u0151v\u00e9 teheti, hogy a t\u00e1mad\u00f3 \u00e1ltal ellen\u0151rz\u00f6tt adatok \u00edr\u00f3djanak ki a lefoglalt pufferen k\u00edv\u00fcli mem\u00f3ria ter\u00fcletre. A hiba akkor jelentkezik, amikor a \"dup\" \u00e9s \"fwd\" szab\u00e1lyok konfigur\u00e1l\u00e1sakor a csatorn\u00e1k eset\u00e9ben, amelyeken hardveres csomagfeldolgoz\u00e1s (offload) t\u00f6rt\u00e9nik. Mivel a t\u00falcsordul\u00e1s a csomagsz\u0171r\u0151 szab\u00e1ly l\u00e9trehoz\u00e1sa \u00e9s az offload t\u00e1mogat\u00e1s\u00e1nak ellen\u0151rz\u00e9se el\u0151tt k\u00f6vetkezik be, a sebezhet\u0151s\u00e9g olyan h\u00e1l\u00f3zati eszk\u00f6z\u00f6kre is vonatkozik, amelyek nem t\u00e1mogatj\u00e1k a hardveres gyors\u00edt\u00e1st, mint p\u00e9ld\u00e1ul a loopback interf\u00e9sz. <\/p>\n
It is noted that the issue is quite easy to exploit since the out-of-bounds values can overwrite the pointer to the net_device structure, and the data about the overwritten value is returned to user space, allowing the necessary addresses for the attack to be discovered in memory. To exploit the vulnerability, specific rules in nftables need to be created, which is only possible with CAP_NET_ADMIN privileges that can be obtained by an unprivileged user in a separate network namespace. The vulnerability can also be used for attacks on container isolation systems. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"