Linux kernel use-after-free in Netfilter, local privilege escalation

Post by TacticalCoder » Wed, May 10, 2023, 11:22 AM UTC

pizzalife wrote: post #10

l33tman wrote: post #8

"We developed an exploit that allows unprivileged local users to start a root shell by abusing the above issue. That exploit was shared privately with to assist with fix development. Somebody from the Linux kernel team then emailed the proposed fix to and that email also included a link to download our description of exploitation techniques and our exploit source code. Therefore, according to the linux-distros list p…

> but the specific module in question in the patch, nf_tables, is not loaded on my Ubuntu 20.04LTS 5.40 kernel running iptables/ufw at least This doesn't matter since Linux has autoloading of most network modules, and you can cause the modules to be loaded on Ubuntu since it supports unprivileged user/net namespaces. ubuntu:~% grep DISTRIB_DESCRIPTION /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 22.04.2 LTS" ubuntu:~…

    ...$  lsmod|grep nf_table    (tried without any just to make sure) 
    ...$  unshare -U -m -n -r
    unshare: unshare: failed: Operation not permitted
    ...$  /sbin/nft add table inet filter
    Error: Could not process rule: Operation not permitted
    add table inet filter
    ^^^^^^^^^^^^^^^^^^^^^^

    root #  cat /proc/sys/kernel/unprivileged_userns_clone
    0

Post by mtlmtlmtlmtl » Wed, May 10, 2023, 11:40 AM UTC

comex wrote: post #34

eklitzke wrote: post #25

Earlier quoted context omitted.

I'm not sure if your claim here is correct. The patch is to change call sites like priv->set->use++; To look like: nf_tables_activate_set(ctx, priv->set); Where this function is defined as: void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) { if (nft_set_is_anonymous(set)) nft_clear(ctx->net, set); set->use++; } So to me (someone who is not an expert in this code) it looks like the fix is che…

One of the parts of Rust’s safety story is to always use smart pointers for reference counting rather than the type of ad-hoc manual reference count management seen in the code you quoted. Combined with lifetime checking, it makes it impossible for some random logic error to cause a use-after-free.

Post by camgunz » Wed, May 10, 2023, 12:08 PM UTC

snvzz wrote: post #74

saagarjha wrote: post #65

Earlier quoted context omitted.

I'm not really in the mood for trolling.

The name-calling is uncalled for. To elaborate, seL4 claims to be the fastest kernel around[0], a claim that remains unchallenged. To put it into context, the difference in IPC speed is such that you'd need an order of magnitude more IPC for a multiserver system based on seL4 to actually be slower than Linux. A multiserver design would imply increased IPC use, but not an order of magnitude. 0. https://trustworthy.sys…

Post by friendzis » Wed, May 10, 2023, 12:21 PM UTC

moring wrote: post #79

mort96 wrote: post #73

Earlier quoted context omitted.

Making a PoC is a great way to convince both yourself and the maintainers that the bug is actually exploitable in the wild and thus a big fucking deal. Alternatively, you might discover that there are some other things going on which turns out to make the bug unexploitable.

Let me rephrase my question: Is there actually such a thing as an "unexploitable use-after-free"? How would that look like? How would you reason that it is actually unexploitable? Context: My experience with C programming is that practically every bug that is related to memory management tends to blow up right into your face, at the most inconvenient time possible.

Post by alex14fr » Wed, May 10, 2023, 12:31 PM UTC

nubinetwork wrote: post #9

TechBro8615 wrote: post #6

Earlier quoted context omitted.

Yes, AFAIU (not an expert), iptables and nftables are two command line tools and abstractions (chains vs. tables) for interacting with the same underlying netfilter API.

I believe at one time they were two separate subsystems, but they got merged in 4.x or 5.x