Bug 2123056 (CVE-2022-2663)

Summary:	CVE-2022-2663 kernel: netfilter: nf_conntrack_irc message handling issue
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bhu, brdeoliv, bskeggs, chwhite, crwood, ddepaula, debarbos, dvlasenk, hdegoede, hkrzesin, hpa, jarod, jarodwilson, jburati, jburrell, jfaracco, jferlan, jforbes, jglisse, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, lleshchi, lzampier, masami256, mchehab, nmurray, ptalbert, qzhao, rvrbovsk, scweaver, steved, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nf_conntrack_irc configured.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 19:17:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2123057, 2124092, 2124093, 2124094, 2124095
Bug Blocks:	2123058

Description Pedro Sampaio 2022-08-31 15:30:26 UTC

An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and it incorrectly matches on the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.

References:

https://www.openwall.com/lists/oss-security/2022/08/30/1
https://lore.kernel.org/netfilter-devel/20220826045658.100360-1-dgl@dgl.cx/T/

Comment 1 Pedro Sampaio 2022-08-31 15:30:52 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2123057]

Comment 4 Justin M. Forbes 2022-09-20 14:07:40 UTC

This was fixed for Fedora with the 5.19.9 stable kernel updates.

Comment 9 errata-xmlrpc 2023-05-09 07:11:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148

Comment 10 errata-xmlrpc 2023-05-09 07:50:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458

Comment 11 errata-xmlrpc 2023-05-16 08:04:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2736 https://access.redhat.com/errata/RHSA-2023:2736

Comment 12 errata-xmlrpc 2023-05-16 08:33:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2951 https://access.redhat.com/errata/RHSA-2023:2951

Comment 13 Product Security DevOps Team 2023-05-16 19:16:58 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2663

Comment 17 errata-xmlrpc 2024-02-07 16:29:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0724 https://access.redhat.com/errata/RHSA-2024:0724