mbox series

[Lunar,OEM-6.1,OEM-6.0,Kinetic,OEM-5.17,Jammy,Focal,0/1] CVE-2023-32233

Message ID 20230510192739.609041-1-cascardo@canonical.com
Headers show
Series CVE-2023-32233 | expand

Message

Thadeu Lima de Souza Cascardo May 10, 2023, 7:27 p.m. UTC 
[Impact]
On systems where user namespaces can be created by unprivileged users,
which is the default configuration on Ubuntu, unprivileged users can
trigger a use-after-free vulnerability on netfilter. This could be used to
crash the system or elevate privileges.

[Test case]
A PoC that crashes the system was tested and the fix has been shown to
prevent it.

[Backport]
The fix applies cleanly all the way back to 5.4 kernels. A backport to 4.15
is in the works.

[Potential impact]
netfilter users may find regressions when manipulating nftables.

Pablo Neira Ayuso (1):
  netfilter: nf_tables: deactivate anonymous set from preparation phase

 include/net/netfilter/nf_tables.h |  1 +
 net/netfilter/nf_tables_api.c     | 12 ++++++++++++
 net/netfilter/nft_dynset.c        |  2 +-
 net/netfilter/nft_lookup.c        |  2 +-
 net/netfilter/nft_objref.c        |  2 +-
 5 files changed, 16 insertions(+), 3 deletions(-)

Comments

Ian May May 10, 2023, 8:10 p.m. UTC | #1 
Acked-by: Ian May <ian.may@canonical.com>

On 2023-05-10 16:27:38 , Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> On systems where user namespaces can be created by unprivileged users,
> which is the default configuration on Ubuntu, unprivileged users can
> trigger a use-after-free vulnerability on netfilter. This could be used to
> crash the system or elevate privileges.
> 
> [Test case]
> A PoC that crashes the system was tested and the fix has been shown to
> prevent it.
> 
> [Backport]
> The fix applies cleanly all the way back to 5.4 kernels. A backport to 4.15
> is in the works.
> 
> [Potential impact]
> netfilter users may find regressions when manipulating nftables.
> 
> Pablo Neira Ayuso (1):
>   netfilter: nf_tables: deactivate anonymous set from preparation phase
> 
>  include/net/netfilter/nf_tables.h |  1 +
>  net/netfilter/nf_tables_api.c     | 12 ++++++++++++
>  net/netfilter/nft_dynset.c        |  2 +-
>  net/netfilter/nft_lookup.c        |  2 +-
>  net/netfilter/nft_objref.c        |  2 +-
>  5 files changed, 16 insertions(+), 3 deletions(-)
> 
> -- 
> 2.34.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
Cory Todd May 10, 2023, 8:21 p.m. UTC | #2 
On Wed, May 10, 2023 at 04:27:38PM -0300, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> On systems where user namespaces can be created by unprivileged users,
> which is the default configuration on Ubuntu, unprivileged users can
> trigger a use-after-free vulnerability on netfilter. This could be used to
> crash the system or elevate privileges.
> 
> [Test case]
> A PoC that crashes the system was tested and the fix has been shown to
> prevent it.
> 
> [Backport]
> The fix applies cleanly all the way back to 5.4 kernels. A backport to 4.15
> is in the works.
> 
> [Potential impact]
> netfilter users may find regressions when manipulating nftables.
> 
> Pablo Neira Ayuso (1):
>   netfilter: nf_tables: deactivate anonymous set from preparation phase
> 
>  include/net/netfilter/nf_tables.h |  1 +
>  net/netfilter/nf_tables_api.c     | 12 ++++++++++++
>  net/netfilter/nft_dynset.c        |  2 +-
>  net/netfilter/nft_lookup.c        |  2 +-
>  net/netfilter/nft_objref.c        |  2 +-
>  5 files changed, 16 insertions(+), 3 deletions(-)
> 
> -- 
> 2.34.1

Acked-by: Cory Todd <cory.todd@canonical.com>
Luke Nowakowski-Krijger May 11, 2023, 4:23 p.m. UTC | #3 
Applied to lunar, kinetic, jammy, focal linux master-next

Thanks,
- Luke

On Wed, May 10, 2023 at 9:29 PM Thadeu Lima de Souza Cascardo <
cascardo@canonical.com> wrote:

> [Impact]
> On systems where user namespaces can be created by unprivileged users,
> which is the default configuration on Ubuntu, unprivileged users can
> trigger a use-after-free vulnerability on netfilter. This could be used to
> crash the system or elevate privileges.
>
> [Test case]
> A PoC that crashes the system was tested and the fix has been shown to
> prevent it.
>
> [Backport]
> The fix applies cleanly all the way back to 5.4 kernels. A backport to 4.15
> is in the works.
>
> [Potential impact]
> netfilter users may find regressions when manipulating nftables.
>
> Pablo Neira Ayuso (1):
>   netfilter: nf_tables: deactivate anonymous set from preparation phase
>
>  include/net/netfilter/nf_tables.h |  1 +
>  net/netfilter/nf_tables_api.c     | 12 ++++++++++++
>  net/netfilter/nft_dynset.c        |  2 +-
>  net/netfilter/nft_lookup.c        |  2 +-
>  net/netfilter/nft_objref.c        |  2 +-
>  5 files changed, 16 insertions(+), 3 deletions(-)
>
> --
> 2.34.1
>
>
> --
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
Timo Aaltonen May 18, 2023, 12:01 p.m. UTC | #4 
Thadeu Lima de Souza Cascardo kirjoitti 10.5.2023 klo 22.27:
> [Impact]
> On systems where user namespaces can be created by unprivileged users,
> which is the default configuration on Ubuntu, unprivileged users can
> trigger a use-after-free vulnerability on netfilter. This could be used to
> crash the system or elevate privileges.
> 
> [Test case]
> A PoC that crashes the system was tested and the fix has been shown to
> prevent it.
> 
> [Backport]
> The fix applies cleanly all the way back to 5.4 kernels. A backport to 4.15
> is in the works.
> 
> [Potential impact]
> netfilter users may find regressions when manipulating nftables.
> 
> Pablo Neira Ayuso (1):
>    netfilter: nf_tables: deactivate anonymous set from preparation phase
> 
>   include/net/netfilter/nf_tables.h |  1 +
>   net/netfilter/nf_tables_api.c     | 12 ++++++++++++
>   net/netfilter/nft_dynset.c        |  2 +-
>   net/netfilter/nft_lookup.c        |  2 +-
>   net/netfilter/nft_objref.c        |  2 +-
>   5 files changed, 16 insertions(+), 3 deletions(-)
> 

applied to oem kernels, thanks