oss-sec mailing list archives
CVE-2022-2588 - Linux kernel cls_route UAF
From: Thadeu Lima de Souza Cascardo <cascardo () canonical com>
Date: Tue, 9 Aug 2022 14:11:54 -0300
CVE-2022-2588 - Linux kernel cls_route UAF It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. Zhenpeng Lin working with Trend Micro's Zero Day Initiative discovered that this vulnerability could be exploited for Local Privilege Escalation. This has been reported as ZDI-CAN-17440, and assigned CVE-2022-2588. This bug has been present since the first Linux commit git, v2.6.12-rc2. Exploiting it requires CAP_NET_ADMIN in any user or network namespace. It can be mitigated by those users who do not rely on cls_route, by adding 'install cls_route /bin/true' to their modprobe.conf or modprobe.d configs, in case it's built as a module. A PoC that will trigger a WARNING is going to be posted in a week. Fixes have been sent to netdev () vger kernel org and are at https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo () canonical com/T/#u.
Current thread:
- CVE-2022-2588 - Linux kernel cls_route UAF Thadeu Lima de Souza Cascardo (Aug 09)
- Re: CVE-2022-2588 - Linux kernel cls_route UAF Vegard Nossum (Aug 09)
- Re: CVE-2022-2588 - Linux kernel cls_route UAF Thadeu Lima de Souza Cascardo (Aug 18)