CVE-2022-34918: Buffer Overflow
First published: Sat Jul 02 2022(Updated: )
A heap buffer overflow flaw was found in the Linux kernel’s Netfilter subsystem in the way a user provides incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <0:5.14.0-70.26.1.el9_0 | 0:5.14.0-70.26.1.el9_0 |
| redhat/kernel-rt | <0:5.14.0-70.26.1.rt21.98.el9_0 | 0:5.14.0-70.26.1.rt21.98.el9_0 |
| redhat/Linux kernel | <5.19 | 5.19 |
| Linux Linux kernel | >=4.1<4.14.316 | |
| Linux Linux kernel | >=4.15<4.19.284 | |
| Linux Linux kernel | >=4.20<5.4.244 | |
| Linux Linux kernel | >=5.5<5.10.130 | |
| Linux Linux kernel | >=5.11<5.15.54 | |
| Linux Linux kernel | >=5.16<5.18.11 | |
| Debian Debian Linux | =11.0 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =20.04 | |
| Canonical Ubuntu Linux | =22.04 | |
| Netapp H300s Firmware | ||
| Netapp H300s | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| All of | ||
| Netapp H300s | ||
| Netapp H300s Firmware | ||
| All of | ||
| Netapp H500s | ||
| Netapp H500s Firmware | ||
| All of | ||
| Netapp H700s | ||
| Netapp H700s Firmware | ||
| All of | ||
| Netapp H410s | ||
| Netapp H410s Firmware | ||
| All of | ||
| Netapp H410c | ||
| Netapp H410c Firmware | ||
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Remedy
In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.
Remedy
Unprivileged user namespaces can be disabled via: sudo sysctl kernel.unprivileged_userns_clone=0 This will affect browser sandboxing, container runtimes, etc. so may not be appropriate for all environments.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-34918 https://nvd.nist.gov/vuln/detail/CVE-2022-34918 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 https://lore.kernel.org/netdev/20220702115948.5de8b1e0@kernel.org/T/ https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/
- https://bugzilla.redhat.com/show_bug.cgi?id=2104423
- https://access.redhat.com/errata/RHSA-2022:6610
- https://access.redhat.com/errata/RHSA-2022:6582
- https://access.redhat.com/errata/RHSA-2022:6592
- https://access.redhat.com/security/cve/cve-2022-34918
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6
- https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/#u
- https://www.openwall.com/lists/oss-security/2022/07/02/3
- http://www.openwall.com/lists/oss-security/2022/07/05/1
- https://www.randorisec.fr/crack-linux-firewall/
- https://www.debian.org/security/2022/dsa-5191
- http://www.openwall.com/lists/oss-security/2022/08/06/5
- https://security.netapp.com/advisory/ntap-20220826-0004/
- http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html
- http://packetstormsecurity.com/files/168543/Netfilter-nft_set_elem_init-Heap-Overflow-Privilege-Escalation.html
- https://launchpad.net/bugs/cve/CVE-2022-34918
- https://access.redhat.com/security/cve/CVE-2022-32250
- https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2104586
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2104423#c3
- https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452%40randorisec.fr/T/#u
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34918
- https://nvd.nist.gov/vuln/detail/CVE-2022-34918
- https://security-tracker.debian.org/tracker/CVE-2022-34918
- https://ubuntu.com/security/CVE-2022-34918
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-34918
- agent/software-canonical-lookup
- agent/author
- agent/weakness
- agent/remedy
- agent/severity
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.1
- version/linux linux kernel/4.15
- version/linux linux kernel/4.20
- version/linux linux kernel/5.5
- version/linux linux kernel/5.11
- version/linux linux kernel/5.16
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/20.04
- version/canonical ubuntu linux/22.04
- vendor/netapp
- canonical/netapp h300s firmware
- canonical/netapp h300s
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- package-manager/debian