Bug 2093146 (CVE-2022-1966) - CVE-2022-1966 kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write)
Summary: CVE-2022-1966 kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-1966
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2093147
TreeView+ depends on / blocked
 
Reported: 2022-06-03 06:10 UTC by TEJ RATHI
Modified: 2024-12-02 07:49 UTC (History)
55 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-06-03 07:36:04 UTC
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2022-06-03 06:10:24 UTC 
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

https://www.openwall.com/lists/oss-security/2022/05/31/1
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd
Comment 1 Rohit Keshri 2022-06-03 07:36:04 UTC 

*** This bug has been marked as a duplicate of bug 2092427 ***
Note You need to log in before you can comment on or make changes to this bug.