[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2022-29581: Linux kernel cls_u32 UAF
From:       Kyle Zeng <zengyhkyle () gmail ! com>
Date:       2022-05-18 19:39:52
Message-ID: CADW8OBvo2NjaNEGsFsaT3QX3UtqvuLJbL07Kgwc1+qrJ51LiQQ () mail ! gmail ! com
[Download RAW message or body]

Hi there,

I recently discovered that a patch in Linux kernel upstream has
security implications. And some vendor-maintained kernels were still
affected when I checked on May 17th.

# Impact
I wrote a proof-of-concept exploit and demonstrated that it can be
used to achieve local privilege escalation.

# Vulnerability
The vulnerability lies in the u32 network traffic classifier and it is
enabled in most vendors. When u32_change function is called and it
enters an error path, it will mistakenly reduce the refcount of the
current network namespace, which can lead to UAF of the "struct net"
data structure that is associated with the current net namespace. This
UAF can lead to local privilege escalation.

# Patch
The patch is merged into Linux kernel main tree already and can be
found here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8.


# Disclosure
I reported it to Google on Apr 21st, a CVE was allocated on Apr 22nd,
and the detail was made public on May 17th.

--
Kyle Zeng


[prev in list] [next in list] [prev in thread] [next in thread]