[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CADW8OBvo2NjaNEGsFsaT3QX3UtqvuLJbL07Kgwc1+qrJ51LiQQ@mail.gmail.com>
Date: Wed, 18 May 2022 12:39:52 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-29581: Linux kernel cls_u32 UAF
Hi there,
I recently discovered that a patch in Linux kernel upstream has
security implications. And some vendor-maintained kernels were still
affected when I checked on May 17th.
# Impact
I wrote a proof-of-concept exploit and demonstrated that it can be
used to achieve local privilege escalation.
# Vulnerability
The vulnerability lies in the u32 network traffic classifier and it is
enabled in most vendors. When u32_change function is called and it
enters an error path, it will mistakenly reduce the refcount of the
current network namespace, which can lead to UAF of the "struct net"
data structure that is associated with the current net namespace. This
UAF can lead to local privilege escalation.
# Patch
The patch is merged into Linux kernel main tree already and can be
found here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8.
# Disclosure
I reported it to Google on Apr 21st, a CVE was allocated on Apr 22nd,
and the detail was made public on May 17th.
--
Kyle Zeng
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
