Linux kernel use-after-free in Netfilter, local privilege escalation

Post by pizzalife » Tue, May 09, 2023, 10:29 PM UTC

0x006A wrote: post #7

knorker wrote: post #4

> delete an existing nft rule that uses an nft anonymous set. And an example of the latter operation is an attempt to delete an element from that nft anonymous set after the set gets deleted I'd be very interested to hear how this can be done by an unprivileged user. Try to race set add/removals, sure, but if it depends on the set itself getting deleted, that seems… harder.

on https://bugzilla.redhat.com/show_bug.cgi?id=2196105 a comment suggests that it might only be possible if you have "unprivileged user namespaces" enabled

Post by pizzalife » Tue, May 09, 2023, 10:32 PM UTC

thelastparadise wrote: post #12

l33tman wrote: post #8

"We developed an exploit that allows unprivileged local users to start a root shell by abusing the above issue. That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code. Therefore, according to the linux-distros list p…

I don't think the bug itself is newsworthy. The existence of the exploit code, and the way that it was accidentally published, I think are.

Post by candiddevmike » Tue, May 09, 2023, 10:51 PM UTC

l33tman wrote: post #8

"We developed an exploit that allows unprivileged local users to start a root shell by abusing the above issue. That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code. Therefore, according to the linux-distros list p…

Post by fnordpiglet » Tue, May 09, 2023, 11:27 PM UTC

Post by veonik » Tue, May 09, 2023, 11:58 PM UTC

pizzalife wrote: post #10

l33tman wrote: post #8

"We developed an exploit that allows unprivileged local users to start a root shell by abusing the above issue. That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code. Therefore, according to the linux-distros list p…

> but the specific module in question in the patch, nf_tables, is not loaded on my Ubuntu 20.04LTS 5.40 kernel running iptables/ufw at least This doesn't matter since Linux has autoloading of most network modules, and you can cause the modules to be loaded on Ubuntu since it supports unprivileged user/net namespaces. ubuntu:~% grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 22.04.2 LTS" ubuntu:~…