Описание
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets (AF_PACKET) used PACKET_COPY_THRESH and mmap operations. A local attacker with CAP_NET_RAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege escalation.
Отчет
Only local users with CAP_NET_RAW capability enabled can trigger this issue. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be gained by exploiting unprivileged user namespaces.
In a default or common use of Red Hat Enterprise Linux 7 unprivileged user namespaces are disabled by default, so local unprivileged users cannot abuse namespaces to grant themselves the CAP_NET_RAW capability and potentially elevate their privileges on the system.
Меры по смягчению последствий
The mitigation is to disable CAP_NET_RAW capability for regular users and executables to prevent access to raw packet sockets (AF_PACKET). On Red Hat Enterprise Linux 8, the mitigation is to either disable unprivileged user namespaces with sysctl -w user.max_user_namespaces=0 or network namespaces with sysctl -w user.max_net_namespaces=0. For more information on how to set sysctl variables on Red Hat Enterprise Linux, please refer to https://access.redhat.com/solutions/2587.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2022:7444 | 08.11.2022 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2022:7683 | 08.11.2022 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | kernel | Fixed | RHSA-2024:0930 | 21.02.2024 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2022:8267 | 15.11.2022 |
| Red Hat Enterprise Linux 9 | kernel-rt | Fixed | RHSA-2022:7933 | 15.11.2022 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2022:8267 | 15.11.2022 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2024:0930 | 21.02.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Product: AndroidVersions: Android kernelAndroid ID: A-224546354Referen ...
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
Уязвимость функции packet_recvmsg() ядра операционной системы Android, позволяющая нарушителю выполнить произвольный код
EPSS
7 High
CVSS3