CVE-2022-32250 HIGH

Published: 2022-06-02 | Last Modified: 2024-11-21 | Status: Modified

Description

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

Additional Descriptions (1)

El archivo net/netfilter/nf_tables_api.c en el kernel de Linux versiones hasta 5.18.1, permite a un usuario local (capaz de crear espacios de nombres de usuario/red) escalar privilegios a root porque una comprobación incorrecta de NFT_STATEFUL_EXPR conlleva a un uso de memoria previamente liberada

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-416

Affected Products

Vendor	Product	Version	Update	Type
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e824c0>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e83300>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e80900>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e80800>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e81e00>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e82e80>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd369e82740>	Operating System
linux	linux_kernel	*	<built-in method update of dict object at 0x7fd36b85d880>	Operating System
fedoraproject	fedora	35	<built-in method update of dict object at 0x7fd369e81d80>	Operating System
fedoraproject	fedora	36	<built-in method update of dict object at 0x7fd369e82840>	Operating System
debian	debian_linux	9.0	<built-in method update of dict object at 0x7fd3602766c0>	Operating System
debian	debian_linux	10.0	<built-in method update of dict object at 0x7fd384e2a8c0>	Operating System
netapp	h300s_firmware	-	<built-in method update of dict object at 0x7fd3686c6980>	Operating System
netapp	h500s_firmware	-	<built-in method update of dict object at 0x7fd384e2afc0>	Operating System
netapp	h700s_firmware	-	<built-in method update of dict object at 0x7fd384e2b700>	Operating System
netapp	h410s_firmware	-	<built-in method update of dict object at 0x7fd36a7dc8c0>	Operating System
netapp	h410c_firmware	-	<built-in method update of dict object at 0x7fd369e81600>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`
Yes	`cpe:2.3:o:linux:linux_kernel::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:fedoraproject:fedora:35:::::::*`
Yes	`cpe:2.3:o:fedoraproject:fedora:36:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
Yes	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h300s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h300s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h500s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h500s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h700s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h700s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410c_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410c:-:::::::*`

References

http://www.openwall.com/lists/oss-security/2022/06/03/1
Source: [email protected]

Exploit Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/04/1
Source: [email protected]

Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/20/1
Source: [email protected]

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/03/5
Source: [email protected]

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/03/6
Source: [email protected]

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/08/25/1
Source: [email protected]

Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/9
Source: [email protected]

Mailing List Third Party Advisory
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
Source: [email protected]

Exploit Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2092427
Source: [email protected]

Issue Tracking Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd
Source: [email protected]

Mailing List Patch Vendor Advisory
https://github.com/theori-io/CVE-2022-32250-exploit
Source: [email protected]

Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
Source: [email protected]

Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/
Source: [email protected]
https://security.netapp.com/advisory/ntap-20220715-0005/
Source: [email protected]

Third Party Advisory
https://www.debian.org/security/2022/dsa-5161
Source: [email protected]

Third Party Advisory
https://www.debian.org/security/2022/dsa-5173
Source: [email protected]

Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/05/31/1
Source: [email protected]

Exploit Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/03/1
Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/04/1
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/20/1
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/03/5
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/03/6
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/08/25/1
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/02/9
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2092427
Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Patch Vendor Advisory
https://github.com/theori-io/CVE-2022-32250-exploit
Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.netapp.com/advisory/ntap-20220715-0005/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.debian.org/security/2022/dsa-5161
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.debian.org/security/2022/dsa-5173
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/05/31/1
Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Mailing List Patch Third Party Advisory