Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 18 May 2022 12:39:52 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-29581: Linux kernel cls_u32 UAF

Hi there,

I recently discovered that a patch in Linux kernel upstream has
security implications. And some vendor-maintained kernels were still
affected when I checked on May 17th.

# Impact
I wrote a proof-of-concept exploit and demonstrated that it can be
used to achieve local privilege escalation.

# Vulnerability
The vulnerability lies in the u32 network traffic classifier and it is
enabled in most vendors. When u32_change function is called and it
enters an error path, it will mistakenly reduce the refcount of the
current network namespace, which can lead to UAF of the "struct net"
data structure that is associated with the current net namespace. This
UAF can lead to local privilege escalation.

# Patch
The patch is merged into Linux kernel main tree already and can be
found here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8.

# Disclosure
I reported it to Google on Apr 21st, a CVE was allocated on Apr 22nd,
and the detail was made public on May 17th.

--
Kyle Zeng

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.