In Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, a vulnerability (CVE-2021-22555) has been identified that allows a local user to gain root privileges in the system, even while in an isolated container. A working exploit prototype has been prepared for testing, bypassing the protections of KASLR, SMAP, and SMEP. The researcher who discovered the vulnerability received a $20,000 reward from Google for finding a method to bypass the Kubernetes container isolation in the kCTF cluster.
The issue has been present since kernel 2.6.19, released 15 years ago, and is caused by a bug in the IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE handlers, leading to a buffer overflow when sending specially crafted parameters through the setsockopt call in compatibility mode. Under normal circumstances, the compat_setsockopt() call can only be executed by the root user, but the necessary privileges for the attack can also be obtained by an unprivileged user in systems with support for user namespace enabled.
A user can create a container with a separate root user and exploit the vulnerability from there. For example, 'user namespaces' are enabled by default in Ubuntu and Fedora, but not activated in Debian and RHEL. A patch to fix the vulnerability was accepted into the Linux kernel on April 13. Updates for the packages have already been prepared by the Debian, Arch Linux, and Fedora projects. In Ubuntu, RHEL, and SUSE, the updates are in preparation.
The problem occurs in the function xt_compat_target_from_user() due to incorrect memory size calculation when saving kernel structures after converting from 32-bit to 64-bit representation. The bug allows writing four zero bytes to any position beyond the allocated buffer, limited by the offset 0x4C. This capability was sufficient to create an exploit that achieves root privileges ā by clearing the pointer m_list->next in the msg_msg structure, conditions were created to access data after memory has been freed (use-after-free), which was then used to obtain address information and modify other structures through manipulation of the msgsnd() system call.
Bron: opennet.ru
