EGI SVG Advisories

Advisory-SVG-CVE-2022-32250

Title:   EGI SVG 'ADVISORY' [TLP:WHITE]  CRITICAL risk Linux kernel's Netfilter vulnerability 
         CVE-2022-32250 [EGI-SVG-CVE-2022-32250] 

Date:    2022-07-05
Updated: 2022-07-07, 2022-09-26

Affected software and risk
==========================
CRITICAL risk vulnerability concerning Linux kernel's Netfilter

Package    : Linux kernel's Netfilter
CVE ID     : CVE-2022-32250
Bug ID     : 
CVSS Score : 7.8 

A vulnerability has been reported concerning the Linux kernel Netfilter 
[R 1]. A use-after-free write vulnerability was identified within the netfilter 
subsystem which can be exploited to achieve privilege escalation to root [R 2]. 
This we consider 'CRITICAL' risk, for sites which have user namespaces enabled. 
According to RedHat, in order to trigger the issue, it requires the ability to 
create user/net namespaces [R 3]. Note that this vulnerability has been renamed 
from CVE-2022-1966 and for some providers that vulnerability refers to this.


Actions required/recommended
============================

Sites are required to urgently install an updated version of the Linux kernel,
as soon as a patched version is available for the distribution they have installed.

Fixed versions are available in RedHat 7, Scientific Linux, and Debian. 

**UPDATE 2022-09-26 Updated version also available at least in Ubuntu**

Sites running distributions where a patched version is not available yet are 
strongly recommended to carry out mitigation, unless this disables functionality required.

Component installation information
==================================

Sites running RHEL should see [R 3]

Sites running Scientific Linux should see [R 4]

Sites running CentOS should also see [R 5]

Sites running Debian should see [R 6]

Sites running Ubuntu should see [R 7]

Sites running RockyLinux should see [R 8] 

Sites running Almalinux should see [R 9]

Mitigation
==========

Mitigation is possible by disabling user namespaces
echo 0 > /proc/sys/user/max_user_namespaces

This is probably not an option for the majority of WLCG sites, where LHC experiments and 
other VOs expect unprivileged Singularity containers to work. 

See also [R 3]

Even if mitigation is an option, EGI SVG strongly recommends updating for distributions 
where patches are available.

**UPDATE 2022-07-07**, 
(further correction **UPDATE 2022-09-26**)
(disable _network_ namespaces, not unprivileged _network_ namespaces.)

It is sufficient to only disable _network_ namespaces instead of disabling 
user namespaces.
Note that we in general recommend to disable  _network_ namespaces unless they 
are explicitly required on the host.

Note that this works for Singularity [R 10], thus allowing unprivileged user namespaces to be 
kept enabled for Singularity. 

However, please note that on RHEL/CentOS 8 and derivatives, there are a few system services that 
by default expect network namespaces to work: please check [R 10] for further information.

More information
================

 net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user 
 (able to create user/net namespaces) to escalate privileges to root because an incorrect 
 NFT_STATEFUL_EXPR check leads to a use-after-free. [R 1]
Also see [R 2], [R 3]

TLP and URL
===========

** WHITE information - Unlimited distribution
 - see https://go.egi.eu/tlp for
   distribution restrictions **
   
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2022-32250
Minor updates may be made without re-distribution to the sites

Comments
========

Comments or questions should be sent to svg-rat  at  mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to

report-vulnerability at egi.eu

the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 99]

References
==========

[R 1] https://nvd.nist.gov/vuln/detail/CVE-2022-32250

[R 2] https://www.openwall.com/lists/oss-security/2022/05/31/1

[R 3] https://access.redhat.com/security/cve/CVE-2022-32250

[R 4] https://www.scientificlinux.org/category/sl-errata/ 

[R 5] https://lists.centos.org/pipermail/centos-announce/ 

[R 6] https://security-tracker.debian.org/tracker/CVE-2022-32250

[R 7] http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2022-32250.html  

[R 8] RockyLinux https://errata.rockylinux.org/ 

[R 9] AlmaLinux https://errata.almalinux.org/ 

[R 10] https://opensciencegrid.org/docs/worker-node/install-singularity/#enabling-unprivileged-singularity

[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867

[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867

Credit
======
SVG was alerted to this vulnerability by Mischa Salle

Timeline
========
Yyyy-mm-dd  [EGI-SVG-2022-CVE-2022-32250] 

2022-07-04 SVG alerted to this issue by Mischa Salle
2022-07-04 Acknowledgement from the EGI SVG to the reporter
2022-07-04 Investigation of vulnerability and relevance to EGI
2022-07-05 EGI SVG Risk Assessment completed
2022-07-05 Advisory sent to sites
2022-07-07 Advisory updated
2022-09-26 Advisory placed on Advisories.egi.eu

Context
=======

This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 99] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.

-----------------------------
This advisory is subject to the Creative commons licence 
https://creativecommons.org/licenses/by/4.0/ 
and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. 
-----------------------------


On behalf of the EGI SVG,