In Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, a vulnerability has been discovered (CVE not assigned) that allows a local user to execute code at the kernel level and elevate their privileges in the system. Researchers demonstrated an exploit that enabled a local user to gain root rights in Ubuntu 22.04 with kernel 5.15.0-39-generic. Initially, the vulnerability information was scheduled for publication on August 15, but due to the copying of a letter containing the exploit prototype to a public mailing list, the disclosure embargo was lifted.
The issue arises starting from the release of kernel 5.8 and is caused by a buffer overflow in the code for handling set lists in the nf_tables module, resulting from a lack of proper checks in the nft_set_elem_init function. The error was introduced in a modification that expanded the storage area for list elements to 128 bytes.
To carry out the attack, access to nftables is required, which can be obtained in a separate network namespace with CLONE_NEWUSER, CLONE_NEWNS, or CLONE_NEWNET rights (for example, when the possibility of running an isolated container is present). A fix is not yet available. To block the exploitation of the vulnerability in ordinary systems, ensure that the creation of namespaces by unprivileged users is disabled (“sudo sysctl -w kernel.unprivileged_userns_clone=0”).
Bron: opennet.ru
