CVE-2022-34918: Buffer Overflow
A heap buffer overflow flaw was found in the Linux kernel’s Netfilter subsystem in the way a user provides incorrect input of the NFTDATAVERDICT type. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
A heap buffer overflow vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root. In order to trigger the issue it requires the ability to create user/net namespaces. The reason of the vulnerability is the type confusion bug in nftseteleminit, and it is different vulnerability than similar CVE-2022-32250.
Reference:
https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/
— Red Hat
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nftseteleminit (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAPNETADMIN access.) This can be fixed in nftsetelemparsedata in net/netfilter/nftablesapi.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.26.1.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.26.1.rt21.98.el9_0 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.19 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Configuration
On non-containerized deployments, disable unprivileged user namespaces by setting user.max_user_namespaces to 0 (e.g., write user.max_user_namespaces=0 to /etc/sysctl.d/userns.conf and apply with sysctl -p /etc/sysctl.d/userns.conf).
Linux kernel sysctl user.max_user_namespaces = 0 - Configuration
Also disable unprivileged user namespace clone by setting kernel.unprivileged_userns_clone=0 (e.g., sudo sysctl kernel.unprivileged_userns_clone=0).
Linux kernel sysctl kernel.unprivileged_userns_clone = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-34918?
CVE-2022-34918 is classified as a high severity vulnerability due to its potential for privilege escalation and system crashes.
How do I fix CVE-2022-34918?
To fix CVE-2022-34918, update the Linux kernel to version 0:5.14.0-70.26.1.el9_0 or later versions listed in the remediation.
Which Linux distributions are affected by CVE-2022-34918?
CVE-2022-34918 affects several Linux distributions including specific versions of Red Hat, Debian, and Ubuntu.
Can CVE-2022-34918 be exploited by remote users?
No, CVE-2022-34918 requires local user access to exploit the vulnerability.
What systems are most at risk from CVE-2022-34918?
Systems running vulnerable versions of the Linux kernel, particularly in environments where user inputs can be manipulated, are at higher risk.