Title: EGI SVG 'ADVISORY' [TLP:WHITE] CRITICAL risk Linux kernel's Netfilter vulnerability
CVE-2022-32250 [EGI-SVG-CVE-2022-32250]
Date: 2022-07-05
Updated: 2022-07-07, 2022-09-26
Affected software and risk
==========================
CRITICAL risk vulnerability concerning Linux kernel's Netfilter
Package : Linux kernel's Netfilter
CVE ID : CVE-2022-32250
Bug ID :
CVSS Score : 7.8
A vulnerability has been reported concerning the Linux kernel Netfilter
[R 1]. A use-after-free write vulnerability was identified within the netfilter
subsystem which can be exploited to achieve privilege escalation to root [R 2].
This we consider 'CRITICAL' risk, for sites which have user namespaces enabled.
According to RedHat, in order to trigger the issue, it requires the ability to
create user/net namespaces [R 3]. Note that this vulnerability has been renamed
from CVE-2022-1966 and for some providers that vulnerability refers to this.
Actions required/recommended
============================
Sites are required to urgently install an updated version of the Linux kernel,
as soon as a patched version is available for the distribution they have installed.
Fixed versions are available in RedHat 7, Scientific Linux, and Debian.
**UPDATE 2022-09-26 Updated version also available at least in Ubuntu**
Sites running distributions where a patched version is not available yet are
strongly recommended to carry out mitigation, unless this disables functionality required.
Component installation information
==================================
Sites running RHEL should see [R 3]
Sites running Scientific Linux should see [R 4]
Sites running CentOS should also see [R 5]
Sites running Debian should see [R 6]
Sites running Ubuntu should see [R 7]
Sites running RockyLinux should see [R 8]
Sites running Almalinux should see [R 9]
Mitigation
==========
Mitigation is possible by disabling user namespaces
echo 0 > /proc/sys/user/max_user_namespaces
This is probably not an option for the majority of WLCG sites, where LHC experiments and
other VOs expect unprivileged Singularity containers to work.
See also [R 3]
Even if mitigation is an option, EGI SVG strongly recommends updating for distributions
where patches are available.
**UPDATE 2022-07-07**,
(further correction **UPDATE 2022-09-26**)
(disable _network_ namespaces, not unprivileged _network_ namespaces.)
It is sufficient to only disable _network_ namespaces instead of disabling
user namespaces.
Note that we in general recommend to disable _network_ namespaces unless they
are explicitly required on the host.
Note that this works for Singularity [R 10], thus allowing unprivileged user namespaces to be
kept enabled for Singularity.
However, please note that on RHEL/CentOS 8 and derivatives, there are a few system services that
by default expect network namespaces to work: please check [R 10] for further information.
More information
================
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user
(able to create user/net namespaces) to escalate privileges to root because an incorrect
NFT_STATEFUL_EXPR check leads to a use-after-free. [R 1]
Also see [R 2], [R 3]
TLP and URL
===========
** WHITE information - Unlimited distribution
- see https://go.egi.eu/tlp for
distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2022-32250
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 99]
References
==========
[R 1] https://nvd.nist.gov/vuln/detail/CVE-2022-32250
[R 2] https://www.openwall.com/lists/oss-security/2022/05/31/1
[R 3] https://access.redhat.com/security/cve/CVE-2022-32250
[R 4] https://www.scientificlinux.org/category/sl-errata/
[R 5] https://lists.centos.org/pipermail/centos-announce/
[R 6] https://security-tracker.debian.org/tracker/CVE-2022-32250
[R 7] http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2022-32250.html
[R 8] RockyLinux https://errata.rockylinux.org/
[R 9] AlmaLinux https://errata.almalinux.org/
[R 10] https://opensciencegrid.org/docs/worker-node/install-singularity/#enabling-unprivileged-singularity
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
Credit
======
SVG was alerted to this vulnerability by Mischa Salle
Timeline
========
Yyyy-mm-dd [EGI-SVG-2022-CVE-2022-32250]
2022-07-04 SVG alerted to this issue by Mischa Salle
2022-07-04 Acknowledgement from the EGI SVG to the reporter
2022-07-04 Investigation of vulnerability and relevance to EGI
2022-07-05 EGI SVG Risk Assessment completed
2022-07-05 Advisory sent to sites
2022-07-07 Advisory updated
2022-09-26 Advisory placed on Advisories.egi.eu
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 99] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
-----------------------------
This advisory is subject to the Creative commons licence
https://creativecommons.org/licenses/by/4.0/
and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited.
-----------------------------
On behalf of the EGI SVG,