CVE-2022-20368: Buffer Overflow
An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets (AFPACKET) used PACKETCOPYTHRESH and mmap operations. A local attacker with CAPNETRAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege escalation.
Other sources
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Syzbot found that when an AFPACKET socket is using PACKETCOPYTHRESH and mmap operations, tpacketrcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy.
Android bulletin: https://source.android.com/docs/security/bulletin/pixel/2022-08-01
Upstream fix: https://github.com/torvalds/linux/commit/c700525fcc06b05adfea78039de02628af79e07a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch c700525fcc06b05adfea78039de02628af79e07a - Configuration
Disable unprivileged user namespaces with sysctl -w user.max_user_namespaces=0 or disable network namespaces with sysctl -w user.max_net_namespaces=0.
Red Hat Enterprise Linux 8 user.max_user_namespaces or user.max_net_namespaces = 0 - Configuration
Disable CAP_NET_RAW capability for regular users and executables to prevent access to raw packet sockets (AF_PACKET).
Linux capabilities CAP_NET_RAW = disabled for regular users and executables
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-20368?
CVE-2022-20368 has been assigned a severity rating of high due to its potential for causing system crashes and privilege escalation.
How do I fix CVE-2022-20368?
To fix CVE-2022-20368, upgrade to the appropriate kernel version such as 0:4.18.0-425.3.1.rt7.213.el8 for el8 systems or 0:5.14.0-162.6.1.el9_1 for el9_1 systems.
Who is affected by CVE-2022-20368?
CVE-2022-20368 affects users and systems running specific versions of the Linux kernel, particularly those with CAP_NET_RAW capability.
What kind of attack could exploit CVE-2022-20368?
An attacker could exploit CVE-2022-20368 by triggering a buffer overflow through raw packet socket operations, leading to a system crash.
Is this vulnerability present in Android systems?
Yes, CVE-2022-20368 could affect Android systems using vulnerable versions of the Linux kernel.