CVE-2022-0435

Published: 10 February 2022

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.

From the Ubuntu Security Team

Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a denial of service (system crash) for systems that have a TIPC bearer configured.

Notes

introduced in v4.8
mitigated by CONFIG_FORTIFY_SOURCE, enabled in Ubuntu
kernels since v4.18 kernels (Ubuntu 18.10 and newer, as well as
HWE kernels for 18.04 LTS), mitigates this into a DoS.
for 4.15 kernels as used in 18.04 LTS and HWE for 16.04 ESM,
kernels are built with stack-protector, which makes this more
difficult to exploit.

Mitigation

Ensure the tipc module is not loaded; unlike many other network
protocols in the Linux kernel, the tipc module cannot be
auto-loaded by an unprivileged user.

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2022/02/10/1
• https://ubuntu.com/security/notices/USN-5302-1
• https://ubuntu.com/security/notices/USN-5337-1
• https://ubuntu.com/security/notices/USN-5338-1
• https://ubuntu.com/security/notices/USN-5339-1
• https://ubuntu.com/security/notices/USN-5362-1
• https://ubuntu.com/security/notices/USN-5368-1
• https://ubuntu.com/security/notices/USN-5377-1
• https://www.cve.org/CVERecord?id=CVE-2022-0435
• NVD
• Launchpad
• Debian