CVE-2022-2663: Medium severity Linux Linux kernel vulnerability
A firewall flaw that can bypass the Linux kernel’s Netfilter functionality was found in how a user handles unencrypted IRC with nfconntrackirc configured. This flaw allows a remote user to gain unauthorized access to the system.
Other sources
An issue was found in the Linux kernel in nfconntrackirc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nfconntrackirc configured.
An issue was found in the Linux kernel in nfconntrackirc where the message handling can be confused and it incorrectly matches on the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nfconntrackirc configured.
References:
https://www.openwall.com/lists/oss-security/2022/08/30/1 https://lore.kernel.org/netfilter-devel/20220826045658.100360-1-dgl@dgl.cx/T/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Configuration
Blacklist nf_conntrack_irc to prevent the module from being loaded automatically.
Linux kernel module nf_conntrack_irc module loading = disabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2663?
CVE-2022-2663 is considered a high severity vulnerability due to its potential to allow unauthorized access to a system.
How do I fix CVE-2022-2663?
To resolve CVE-2022-2663, update to the latest kernel version provided by your distribution, specifically the patched versions for Red Hat or Debian.
What systems are affected by CVE-2022-2663?
CVE-2022-2663 affects multiple versions of the Linux kernel, particularly those in Red Hat and Debian distributions.
What is the impact of CVE-2022-2663?
The impact of CVE-2022-2663 includes the potential for an attacker to bypass firewall protections and gain unauthorized access to the system.
Is CVE-2022-2663 exploitable remotely?
Yes, CVE-2022-2663 is exploitable remotely, allowing unauthorized users to potentially compromise affected systems.