CVE-2022-36946: High severity Linux Linux kernel vulnerability
A Linux Kernel flaw found in the net/netfilter/nfnetlinkqueue.c. If local user creates netfilter rule that truncates the packet below the header size, the skbpull() will result in a malformed skb (skb->len < 0). As result, denial of service could happen after incorrect check in nfqnlmangle function.
Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlinkqueue" netfilter queue handler over nfnetlink")
Reference: https://lore.kernel.org/all/20220726104206.2036-1-fw@strlen.de/t/
Other sources
A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilterqueue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilterqueue is used by a local user.
nfqnlmangle in net/netfilter/nfnetlinkqueue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skbpull can encounter a negative skb->len.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.18.16 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.18.16-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Prevent the nfnetlink_queue module from loading automatically by adding nfnetlink_queue to the kernel module blocklist.
Linux kernel module nfnetlink_queue module blocklist = nfnetlink_queue
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-36946?
CVE-2022-36946 has a high severity rating due to its potential to cause denial of service in the Linux Kernel.
How do I fix CVE-2022-36946?
To fix CVE-2022-36946, update to one of the patched versions listed, such as kernel-rt 0:4.18.0-425.3.1.rt7.213.el8 or kernel 0:5.14.0-162.6.1.el9_1.
Who is affected by CVE-2022-36946?
CVE-2022-36946 affects users of Linux Kernel versions prior to the patched versions listed in the advisory.
What is the impact of CVE-2022-36946?
The impact of CVE-2022-36946 can lead to system instability and denial of service due to improper packet handling.
Is CVE-2022-36946 a local or remote vulnerability?
CVE-2022-36946 is a local vulnerability that can be exploited by a local user to create a denial of service condition.