{"id":103645,"date":"2022-03-29T15:37:18","date_gmt":"2022-03-29T13:37:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec"},"modified":"2022-03-29T15:37:18","modified_gmt":"2022-03-29T13:37:19","slug":"v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-yadre-linux-vyyavleny-ekspluatiruemye-uyazvimosti-v-nf_tables-watch_queue-i-ipsec","title":{"rendered":"A Linux kernelben kihaszn\u00e1lhat\u00f3 sebezhet\u0151s\u00e9geket tal\u00e1ltak az nf_tables, watch_queue \u00e9s IPsec ter\u00fcleteken","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Linux kernel issue has been discovered, revealing several dangerous vulnerabilities that allow local users to elevate their privileges within the system. Working exploit prototypes have been prepared for all the identified issues. <\/p>\n
\n
A sebezhet\u0151s\u00e9g (CVE-2022-0995) az esem\u00e9nyek nyomon k\u00f6vet\u00e9s\u00e9\u00e9rt felel\u0151s watch_queue alszisztem\u00e1ban tal\u00e1lhat\u00f3, amely a kernel mem\u00f3ri\u00e1j\u00e1nak ter\u00fcleteire \u00edrja a adatokat a lefoglalt puffer hat\u00e1rain t\u00fal. A t\u00e1mad\u00e1s b\u00e1rmely, nem privilegiz\u00e1lt felhaszn\u00e1l\u00f3 \u00e1ltal v\u00e9grehajthat\u00f3, \u00e9s a kernel jogainak birtok\u00e1ban l\u00e9v\u0151 k\u00f3d futtat\u00e1s\u00e1hoz vezethet. A sebezhet\u0151s\u00e9g a watch_queue_set_size() f\u00fcggv\u00e9nyben tal\u00e1lhat\u00f3, \u00e9s kapcsol\u00f3dik a lista \u00f6sszes mutat\u00f3j\u00e1nak tiszt\u00edt\u00e1si k\u00eds\u00e9rlet\u00e9hez, m\u00e9g akkor is, ha sz\u00e1mukra nem volt mem\u00f3ria lefoglalva. A probl\u00e9ma akkor nyilv\u00e1nul meg, ha a kernelt a «CONFIG_WATCH_QUEUE=y» opci\u00f3val \u00e1ll\u00edtj\u00e1k \u00f6ssze, amelyet a legt\u00f6bb Linux disztrib\u00faci\u00f3ban haszn\u00e1lnak.\n
The vulnerability has been fixed in the changes added to the kernel on March 11. You can track the publication of package updates in distributions on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A prototype of the exploit is already publicly available and allows obtaining root access when run on Ubuntu 21.10 with kernel 5.13.0-37.
<\/center> <\/p>\n
The vulnerability (CVE-2022-27666) exists in the kernel modules esp4 and esp6, implementing ESP transformation (Encapsulating Security Payload) for IPsec, used for IPv4 and IPv6. This vulnerability allows a local user with normal privileges to overwrite objects in kernel memory, thereby elevating their privileges within the system. The issue arises from the lack of verification of the allocated memory size and the actual received data, although the maximum message size could exceed the maximum memory size allocated for the skb_page_frag_refill structure.\n
The vulnerability has been fixed in the kernel on March 7 (corrected in versions 5.17, 5.16.15, etc.). You can track the publication of package updates on the following pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. A working prototype exploit that allows a regular user to gain root access in the default configuration of Ubuntu Desktop 21.10 has already been posted on GitHub. It is claimed that with minor modifications, the exploit will also work in Fedora and Debian. Notably, this exploit was initially prepared for the pwn2own 2022 competition, but kernel developers discovered and fixed a related issue, prompting the decision to disclose vulnerability details.
![\"A](\"\/wp-content\/uploads\/2022\/03\/9cdfd5bdf66d257757d1a4c600b96249.jpg\")
<\/center> <\/p>\n