Linux kernel local privilege escalation vulnerability (CVE-2022-25636)

Today, I received an email from Tencent Cloud, reminding me that there is a high-risk vulnerability in a VPS. I quickly opened the email to deal with it. It has been repaired, and I would like to share it here. Generally speaking, the system and kernel should be upgraded to the latest version to prevent many security problems.

1、 Vulnerability description

1. Vulnerability name: Linux kernel local privilege escalation vulnerability (CVE-2022-25636)
2. Vulnerability tag: required vulnerability
3. Local utilization: POC exists
4. Vulnerability type: Linux software vulnerability
5. Threat level: high risk
6. CVE No.: CVE-2022-25636
7. Disclosure time: February 22, 2022
8. Vulnerability description: Due to the problem of write out of heap boundary, the netfilter subcomponent in the Linux kernel net/netfilter/nf_dup_netdev.c In nft_fwd_dup_netdev_offload An out of bounds (OOB) memory access flaw was found in. This vulnerability allows local attackers with user accounts on the system to gain access to out of bounds memory, leading to a system crash or privilege escalation threat.

2、 Repair plan

It is recommended to use the official release update package of the operating system of each distribution (direct source code compilation and upgrading may pose compatibility risks).

Debian system user (it needs to be restarted to take effect after the upgrade):

Upgrade kernel version:

 sudo apt-get update && sudo apt-get install --only-upgrade linux-image-amd64 && sudo update-grub

1) Users of the bullseye version are recommended to upgrade to the following version: 5.10.103-1, kernel version view command:

 sudo dpkg -l linux-image-amd64

Ubuntu system users (need to restart to take effect after upgrading):

Upgrade kernel version:

 sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic && sudo update-grub

1) Users of version 20.04 are recommended to upgrade to the following version: 5.4.0-104.118; Kernel version view command:

 sudo dpkg -l linux-image-generic

Temporary mitigation measures:

 sudo sysctl kernel.unprivileged_userns_clone=0

It is found that the server is vulnerable. It is recommended to take snapshot backups of relevant hosts immediately to avoid losses.

Reference link: http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD -202202-1743