7.8
CWE
119 787 122
Advisory Published
CVE Published
CVE Published
Updated

CVE-2022-27666: Buffer Overflow

First published: Tue Mar 08 2022(Updated: )

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/kernel-rt<0:4.18.0-372.13.1.rt7.170.el8_6
0:4.18.0-372.13.1.rt7.170.el8_6
redhat/kernel<0:4.18.0-372.13.1.el8_6
0:4.18.0-372.13.1.el8_6
redhat/kernel<0:4.18.0-147.67.1.el8_1
0:4.18.0-147.67.1.el8_1
redhat/kernel-rt<0:4.18.0-193.87.1.rt13.137.el8_2
0:4.18.0-193.87.1.rt13.137.el8_2
redhat/kernel<0:4.18.0-193.87.1.el8_2
0:4.18.0-193.87.1.el8_2
redhat/kernel-rt<0:4.18.0-305.49.1.rt7.121.el8_4
0:4.18.0-305.49.1.rt7.121.el8_4
redhat/kernel<0:4.18.0-305.49.1.el8_4
0:4.18.0-305.49.1.el8_4
redhat/kernel<0:5.14.0-70.17.1.el9_0
0:5.14.0-70.17.1.el9_0
redhat/kernel-rt<0:5.14.0-70.17.1.rt21.89.el9_0
0:5.14.0-70.17.1.rt21.89.el9_0
redhat/kernel<5.17
5.17
Linux Linux kernel<5.17
Linux Linux kernel=5.17
Linux Linux kernel=5.17-rc1
Linux Linux kernel=5.17-rc2
Linux Linux kernel=5.17-rc3
Linux Linux kernel=5.17-rc4
Linux Linux kernel=5.17-rc5
Linux Linux kernel=5.17-rc6
Linux Linux kernel=5.17-rc7
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Redhat Virtualization=4.0
Redhat Enterprise Linux=8.0
All of
Netapp H300s Firmware
Netapp H300s
All of
Netapp H500s Firmware
Netapp H500s
All of
Netapp H700s Firmware
Netapp H700s
All of
Netapp H300e Firmware
Netapp H300e
All of
Netapp H500e Firmware
Netapp H500e
All of
Netapp H700e Firmware
Netapp H700e
All of
Netapp H410s Firmware
Netapp H410s
All of
Netapp H410c Firmware
Netapp H410c
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Netapp H300s Firmware
Netapp H300s
Netapp H500s Firmware
Netapp H500s
Netapp H700s Firmware
Netapp H700s
Netapp H300e Firmware
Netapp H300e
Netapp H500e Firmware
Netapp H500e
Netapp H700e Firmware
Netapp H700e
Netapp H410s Firmware
Netapp H410s
Netapp H410c Firmware
Netapp H410c
ubuntu/linux<4.15.0-175.184
4.15.0-175.184
ubuntu/linux<5.4.0-107.121
5.4.0-107.121
ubuntu/linux<5.13.0-39.44
5.13.0-39.44
ubuntu/linux<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws<4.15.0-1126.135
4.15.0-1126.135
ubuntu/linux-aws<5.4.0-1071.76
5.4.0-1071.76
ubuntu/linux-aws<5.13.0-1021.23
5.13.0-1021.23
ubuntu/linux-aws<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.0<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.13<5.13.0-1021.23~20.04.2
5.13.0-1021.23~20.04.2
ubuntu/linux-aws-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.4<5.4.0-1071.76~18.04.1
5.4.0-1071.76~18.04.1
ubuntu/linux-aws-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-5.8<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-fips<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-hwe<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-aws-hwe<4.15.0-1126.135~16.04.2
4.15.0-1126.135~16.04.2
ubuntu/linux-azure<5.4.0-1074.77
5.4.0-1074.77
ubuntu/linux-azure<5.13.0-1021.24
5.13.0-1021.24
ubuntu/linux-azure<4.15.0-1136.149~14.04.1
4.15.0-1136.149~14.04.1
ubuntu/linux-azure<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure<4.15.0-1136.149~16.04.1
4.15.0-1136.149~16.04.1
ubuntu/linux-azure-4.15<4.15.0-1136.149
4.15.0-1136.149
ubuntu/linux-azure-4.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-5.13<5.13.0-1021.24~20.04.1
5.13.0-1021.24~20.04.1
ubuntu/linux-azure-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-5.4<5.4.0-1074.77~18.04.1
5.4.0-1074.77~18.04.1
ubuntu/linux-azure-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-edge<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-fde<5.4.0-1074.77
5.4.0-1074.77
ubuntu/linux-azure-fde<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-fde-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-azure-fips<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-bluefield<5.4.0-1032.35
5.4.0-1032.35
ubuntu/linux-bluefield<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-dell300x<4.15.0-1040.45
4.15.0-1040.45
ubuntu/linux-dell300x<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-fips<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp<5.4.0-1069.73
5.4.0-1069.73
ubuntu/linux-gcp<5.13.0-1023.28
5.13.0-1023.28
ubuntu/linux-gcp<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp<4.15.0-1120.134~16.04.1
4.15.0-1120.134~16.04.1
ubuntu/linux-gcp-4.15<4.15.0-1120.134
4.15.0-1120.134
ubuntu/linux-gcp-4.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-5.13<5.13.0-1023.28~20.04.1
5.13.0-1023.28~20.04.1
ubuntu/linux-gcp-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-5.4<5.4.0-1069.73~18.04.1
5.4.0-1069.73~18.04.1
ubuntu/linux-gcp-5.8<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gcp-fips<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gke<5.4.0-1067.70
5.4.0-1067.70
ubuntu/linux-gke<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gke-4.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gke-5.0<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gke-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gke-5.4<5.4.0-1067.70~18.04.1
5.4.0-1067.70~18.04.1
ubuntu/linux-gke-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gkeop<5.4.0-1038.39
5.4.0-1038.39
ubuntu/linux-gkeop<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gkeop-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-gkeop-5.4<5.4.0-1038.39~18.04.1
5.4.0-1038.39~18.04.1
ubuntu/linux-gkeop-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe<4.15.0-175.184~16.04.1
4.15.0-175.184~16.04.1
ubuntu/linux-hwe-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-5.13<5.13.0-39.44~20.04.1
5.13.0-39.44~20.04.1
ubuntu/linux-hwe-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-5.4<5.4.0-107.121~18.04.1
5.4.0-107.121~18.04.1
ubuntu/linux-hwe-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-5.8<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-hwe-edge<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-ibm<5.4.0-1019.21
5.4.0-1019.21
ubuntu/linux-ibm<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-ibm-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-ibm-5.4<5.4.0-1019.21~18.04.1
5.4.0-1019.21~18.04.1
ubuntu/linux-ibm-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-intel<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-intel-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-intel-iotg<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1
5.15.0-1008.11~20.04.1
ubuntu/linux-intel-iotg-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-iot<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-kvm<4.15.0-1112.115
4.15.0-1112.115
ubuntu/linux-kvm<5.4.0-1061.64
5.4.0-1061.64
ubuntu/linux-kvm<5.13.0-1020.21
5.13.0-1020.21
ubuntu/linux-kvm<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-laptop<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-lowlatency<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-lowlatency-hwe-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-lowlatency-hwe-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-lts-xenial<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-nvidia<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-nvidia-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-5.10<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-5.14<5.14.0-1031.34
5.14.0-1031.34
ubuntu/linux-oem-5.17<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-5.6<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-6.8<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oem-osp1<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle<4.15.0-1091.100
4.15.0-1091.100
ubuntu/linux-oracle<5.4.0-1069.75
5.4.0-1069.75
ubuntu/linux-oracle<5.13.0-1025.30
5.13.0-1025.30
ubuntu/linux-oracle<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle<4.15.0-1091.100~16.04.1
4.15.0-1091.100~16.04.1
ubuntu/linux-oracle-5.0<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle-5.13<5.13.0-1025.30~20.04.1
5.13.0-1025.30~20.04.1
ubuntu/linux-oracle-5.13<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-oracle-5.4<5.4.0-1069.75~18.04.1
5.4.0-1069.75~18.04.1
ubuntu/linux-oracle-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-raspi<5.4.0-1058.65
5.4.0-1058.65
ubuntu/linux-raspi<5.13.0-1024.26
5.13.0-1024.26
ubuntu/linux-raspi<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-raspi-5.4<5.4.0-1058.65~18.04.1
5.4.0-1058.65~18.04.1
ubuntu/linux-raspi-5.4<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-raspi2<4.15.0-1107.114
4.15.0-1107.114
ubuntu/linux-raspi2<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-raspi2-5.3<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-riscv<5.13.0-1019.21
5.13.0-1019.21
ubuntu/linux-riscv<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-riscv-5.11<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-riscv-5.15<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-riscv-5.8<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-riscv-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-snapdragon<4.15.0-1125.134
4.15.0-1125.134
ubuntu/linux-snapdragon<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-starfive<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-starfive-6.5<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
ubuntu/linux-xilinx-zynqmp<5.17~<5.4.188<5.15.29
5.17~
5.4.188
5.15.29
debian/linux
5.10.218-1
5.10.221-1
6.1.94-1
6.1.99-1
6.9.10-1
6.9.12-1

Remedy

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Reference Links

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203