CVE-2022-1015

Published: 28 March 2022

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.

From the Ubuntu Security Team

David Bouman discovered that the netfilter subsystem in the Linux kernel did not properly validate passed user register indices. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

Notes

requires CAP_NET_ADMIN, however this can be done within a new
user namespace and network namespace - so can be mitigated by disabling
unprivileged user namespaces.

Mitigation

if not needed, disable unprivileged user namespaces:
  sysctl -w kernel.unprivileged_userns_clone=0

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2022/03/28/5
• https://ubuntu.com/security/notices/USN-5381-1
• https://ubuntu.com/security/notices/USN-5383-1
• https://ubuntu.com/security/notices/USN-5390-1
• https://ubuntu.com/security/notices/USN-5390-2
• https://www.cve.org/CVERecord?id=CVE-2022-1015
• NVD
• Launchpad
• Debian