Select Page

A newly disclosed security flaw in the Linux kernel could be leveraged by a local adversary to gain elevated privileges on vulnerable systems to execute arbitrary code, escape containers, or induce a kernel panic.

Tracked as CVE-2022-25636 (CVSS score: 7.8), the vulnerability impacts Linux kernel versions 5.4 through 5.6.10 and is a result of a heap out-of-bounds write in the netfilter subcomponent in the kernel. The issue was discovered by Nick Gregory, a senior threat researcher at Sophos.

“This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat,” Red Hat said in an advisory published on February 22, 2022. Similar alerts have been released by DebianOracle LinuxSUSE, and Ubuntu.

Netfilter is a framework provided by the Linux kernel that enables various networking-related operations, including packet filtering, network address translation, and port translation.

Specifically, CVE-2022-25636 relates to an issue with incorrect handling of the framework’s hardware offload feature that could be weaponized by a local attacker to cause a denial-of-service (DoS) or possibly execute arbitrary code.

images from Hacker News