Linux: Vulnerabilities in nf_tables cause privilege escalation, information leak

<a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-1015" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-1015</a><p><a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-1016" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-1016</a><p><a href="https:&#x2F;&#x2F;access.redhat.com&#x2F;security&#x2F;cve&#x2F;CVE-2022-1015" rel="nofollow">https:&#x2F;&#x2F;access.redhat.com&#x2F;security&#x2F;cve&#x2F;CVE-2022-1015</a><p><a href="https:&#x2F;&#x2F;access.redhat.com&#x2F;security&#x2F;cve&#x2F;CVE-2022-1016" rel="nofollow">https:&#x2F;&#x2F;access.redhat.com&#x2F;security&#x2F;cve&#x2F;CVE-2022-1016</a><p><a href="https:&#x2F;&#x2F;ubuntu.com&#x2F;security&#x2F;CVE-2022-1015" rel="nofollow">https:&#x2F;&#x2F;ubuntu.com&#x2F;security&#x2F;CVE-2022-1015</a><p><a href="https:&#x2F;&#x2F;ubuntu.com&#x2F;security&#x2F;CVE-2022-1016" rel="nofollow">https:&#x2F;&#x2F;ubuntu.com&#x2F;security&#x2F;CVE-2022-1016</a><p><a href="https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-1015" rel="nofollow">https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-1015</a><p><a href="https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-1016" rel="nofollow">https:&#x2F;&#x2F;security-tracker.debian.org&#x2F;tracker&#x2F;CVE-2022-1016</a><p>I just spent the whole weekend patching whatever the last kernel vuln was and had to plan around like 20 people&#x27;s schedules. I thought Meltdown&#x2F;Spectre was bad, this year is already feeling like that year in repeat.<p>15 years as a sysadmin, anyone have suggestions for my next career move? Thanks.

Its yet another int overflow bug too. Something like a kernel should probably be built with saturating arithmetic rather than the stupid C overflow behavior.

There are over 1.412 nodes in the nftables syntax tree (as of 2019).<p>I know. I wrote a Vim syntax hilighter for nftables.<p>And it is still failing.<p>Just imagine how much untested surface area is that for the `nft` CLI.<p>My work: <a href="https:&#x2F;&#x2F;egbert.net&#x2F;blog&#x2F;tags&#x2F;vim.html" rel="nofollow">https:&#x2F;&#x2F;egbert.net&#x2F;blog&#x2F;tags&#x2F;vim.html</a>

Yet another CLONE_NEWUSER and fly away to victory privilege escalation. Really seems like enabling that was premature.

Exploitable uninitialized stack variables in 2022! Remarkable.

I don&#x27;t understand, does this lead to privilege escalation by parsing a crafted netfilter rule? I am under the impression that I need NET_CAP_ADMIN or root privs to do this on my machines to load said rule anyway, right? So this affects deployments where regular users are able to do send netfilter rules to the kernel, right?

You can&#x27;t have privilege escalation if everyone is root, modern problems require modern solutions.

Out of bounds access, uninitialized stack data with an extremely weak language that doesn’t check any of that and happily compiles that hidden footgun gives you an escalation of privileges vulnerability.<p>Perhaps Rust would have prevented this in the first place. But the entirety of Linux and the ancient UNIX philosophy is a giant labyrinth full of cobwebs riddled with hidden traps, landmines and trip-wires beyond exploring.<p>Must be the worlds largest and endless minesweeper game discovering all those C style vulnerabilities in the Linux kernel.

As an early career developer I feel helpless with the vast world of cyber security looming all around me, and not that many people thinking very much about it.<p>It feels kind of like COVID in 2022. Obviously everywhere. Probably not going to hurt me? Could end my career.

Is this something that only affects linux servers, or are desktop users affected as well? Apologies if this question is too noob-ish.

This is what I gathered from looking around:<p>1016 comes from an uninitialized value. 1015 is an int8 overflow and out-of-bounds access. Both are C footguns (though not exclusive to C). The latter arguably might not have happened under a stable&#x2F;specified ABI.<p>1015:<p><pre><code> Introduced in 5.12 Fixed in 6e1acfa387b9, 2022-03-17 In LTS, fixed in 5.10.109 and 5.15.32 Also, in 5.16.18 and 5.17.1 </code></pre> 1016:<p><pre><code> Introduced in v3.13-rc1 Fixed in 4c905f6740a3, 2022-03-17 Fixed in same point releases as above, plus 5.10.109 Doesn&#x27;t look fixed in older LTSes yet</code></pre>

What&#x27;s the practical exposure to CLONE_NEWUSER | CLONE_NEWNET?

I&#x27;m going back to kernel 2.6 .

Is this remotely exploitable or is it only a local vulnerability?

Makes sense for a program which uses the command nft &#x2F;s

Here comes the Rust people saying... should build everything in Rust it will fix all your problems and solve world hunger.