During his internship at RandoriSec, Arthur Mongodin investigated netfilter, the Linux kernel’s firewall component, and found a weird comparison that does not fully protect a copy within a buffer.
The resulting heap buffer overflow, CVE-2022-34918, was exploited to obtain root on Ubuntu 22.04 with kernel Linux ubuntu 5.15.0-39-generic, and the exploit source is on GitHub.
The original report on oss-security has the details: in nft_set_elem_init the allocation uses the element’s data length while the copy uses the set’s, because the length check in nft_setelem_parse_data is skipped for verdict data.
Kernels from 5.8 onward are affected, and the required CAP_NET_ADMIN is available to anyone inside an unprivileged user namespace.
The report was meant for the embargoed linux-distros list but was also CC’d to the public netfilter-devel list, so the embargo lasted exactly as long as it took to hit send.
