{"id":104585,"date":"2022-07-03T15:36:40","date_gmt":"2022-07-03T13:36:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lokalnaya-uyazvimost-v-nftables-pozvolyayushhaya-povysit-svoi-privilegii"},"modified":"2022-07-03T15:36:40","modified_gmt":"2022-07-03T13:36:40","slug":"lokalnaya-uyazvimost-v-nftables-pozvolyayushhaya-povysit-svoi-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/lokalnaya-uyazvimost-v-nftables-pozvolyayushhaya-povysit-svoi-privilegii","title":{"rendered":"Lokale kwetsbaarheid in nftables die het mogelijk maakt om privileges te verhogen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In Netfilter, the Linux kernel subsystem used for filtering and modifying network packets, a vulnerability has been discovered (CVE not assigned) that allows a local user to execute code at the kernel level and elevate their privileges in the system. Researchers demonstrated an exploit that enabled a local user to gain root rights in Ubuntu 22.04 with kernel 5.15.0-39-generic. Initially, the vulnerability information was scheduled for publication on August 15, but due to the copying of a letter containing the exploit prototype to a public mailing list, the disclosure embargo was lifted. <\/p>\n
The issue arises starting from the release of kernel 5.8 and is caused by a buffer overflow in the code for handling set lists in the nf_tables module, resulting from a lack of proper checks in the nft_set_elem_init function. The error was introduced in a modification that expanded the storage area for list elements to 128 bytes. <\/p>\n
Voor het uitvoeren van een aanval is toegang tot nftables vereist, welke kan worden verkregen in een apart netwerkruimte (network namespaces) bij aanwezigheid van de rechten CLONE_NEWUSER, CLONE_NEWNS of CLONE_NEWNET (bijvoorbeeld bij de mogelijkheid om een ge\u00efsoleerde container te draaien). Een oplossing is nog niet beschikbaar. Om de exploitatie van de kwetsbaarheid te blokkeren in reguliere systemen, dient men ervoor te zorgen dat het cre\u00ebren van namespaces door niet-bevoorrechte gebruikers is uitgeschakeld («sudo sysctl -w kernel.unprivileged_userns_clone=0»). \n Bron: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"