In Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, a vulnerability has been discovered (CVE not assigned) that allows a local user to execute code at the kernel level and escalate their privileges in the system. Researchers demonstrated an exploit that enabled a local user to gain root rights in Ubuntu 22.04 with kernel 5.15.0-39-generic. Initially, the information about the vulnerability was slated for publication on August 15, but due to the email containing the exploit prototype being copied to a public mailing list, the embargo on the disclosure was lifted.
The problem manifests starting from the 5.8 kernel release and is caused by a buffer overflow in the code handling set lists in the nf_tables module, which occurred due to a lack of proper checks in the nft_set_elem_init function. The error was introduced in a change that expanded the storage area for list elements to 128 bytes.
To conduct an attack, access to nftables is required, which can be obtained in a separate network namespace when possessing CLONE_NEWUSER, CLONE_NEWNS, or CLONE_NEWNET privileges (for instance, when the ability to launch an isolated container is available). A fix is not yet available. To block the exploitation of the vulnerability in regular systems, ensure the ability of non-privileged users to create namespaces is disabled ('sudo sysctl -w kernel.unprivileged_userns_clone=0').
Fonte: opennet.ru
