CVE-2022-1015: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.
Other sources
A vulnerability was found in nftvalidateregisterstore and nftvalidateregisterload in linux/net/netfilter/nftablesapi.c of the netfilter subsystem in the Linux kernel.
In order for an unprivileged attacker to exploit this issue, unprivileged user- and network namespaces access is required (CLONENEWUSER | CLONENEWNET).
The vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data. This can lead to arbitrary code execution by an attacker
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.16.18 - Configuration
If unprivileged user namespaces are not needed, disable them with: sysctl -w kernel.unprivileged_userns_clone=0
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1015?
CVE-2022-1015 has a high severity level due to its potential to allow local users to execute out-of-bounds writes that can lead to system instability.
How do I fix CVE-2022-1015?
To fix CVE-2022-1015, update the Linux kernel to version 5.16.18 or apply any available patches that address this vulnerability.
Which systems are affected by CVE-2022-1015?
CVE-2022-1015 affects various Linux kernel versions prior to 5.16.18 and specific distributions like Fedora 35 and Debian's linux package.
What type of vulnerability is CVE-2022-1015?
CVE-2022-1015 is an out-of-bounds write vulnerability in the netfilter subsystem of the Linux kernel.
Who can exploit CVE-2022-1015?
CVE-2022-1015 can potentially be exploited by local users with unprivileged access to the system, aiming to cause a denial-of-service or gain unauthorized privileges.