oss-sec mailing list archives
CVE-2022-29581: Linux kernel cls_u32 UAF
From: Kyle Zeng <zengyhkyle () gmail com>
Date: Wed, 18 May 2022 12:39:52 -0700
Hi there, I recently discovered that a patch in Linux kernel upstream has security implications. And some vendor-maintained kernels were still affected when I checked on May 17th. # Impact I wrote a proof-of-concept exploit and demonstrated that it can be used to achieve local privilege escalation. # Vulnerability The vulnerability lies in the u32 network traffic classifier and it is enabled in most vendors. When u32_change function is called and it enters an error path, it will mistakenly reduce the refcount of the current network namespace, which can lead to UAF of the "struct net" data structure that is associated with the current net namespace. This UAF can lead to local privilege escalation. # Patch The patch is merged into Linux kernel main tree already and can be found here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8. # Disclosure I reported it to Google on Apr 21st, a CVE was allocated on Apr 22nd, and the detail was made public on May 17th. -- Kyle Zeng
Current thread:
- CVE-2022-29581: Linux kernel cls_u32 UAF Kyle Zeng (May 18)