CVE-2022-1016

Published: 28 March 2022

The nft_do_chain routine in net/netfilter/nf_tables_core.c does not initialize the register data that nf_tables expressions can read from- and write to. These expressions inherently exhibit side effects that can be used to determine the register data, which can contain kernel image pointers, module pointers, and allocation pointers depending on the code path taken to end up at nft_do_chain.

From the Ubuntu security team

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory).

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1016
• https://www.openwall.com/lists/oss-security/2022/03/28/5
• https://ubuntu.com/security/notices/USN-5381-1
• https://ubuntu.com/security/notices/USN-5383-1
• https://ubuntu.com/security/notices/USN-5390-1
• https://ubuntu.com/security/notices/USN-5390-2
• https://ubuntu.com/security/notices/USN-5415-1
• NVD
• Launchpad
• Debian

Bugs