Date: Wed, 18 May 2022 12:39:52 -0700 From: Kyle Zeng <zengyhkyle@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2022-29581: Linux kernel cls_u32 UAF Hi there, I recently discovered that a patch in Linux kernel upstream has security implications. And some vendor-maintained kernels were still affected when I checked on May 17th. # Impact I wrote a proof-of-concept exploit and demonstrated that it can be used to achieve local privilege escalation. # Vulnerability The vulnerability lies in the u32 network traffic classifier and it is enabled in most vendors. When u32_change function is called and it enters an error path, it will mistakenly reduce the refcount of the current network namespace, which can lead to UAF of the "struct net" data structure that is associated with the current net namespace. This UAF can lead to local privilege escalation. # Patch The patch is merged into Linux kernel main tree already and can be found here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8. # Disclosure I reported it to Google on Apr 21st, a CVE was allocated on Apr 22nd, and the detail was made public on May 17th. -- Kyle Zeng
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.