CVE-2022-1972
Published: 2 June 2022
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2078. Reason: This candidate is a reservation duplicate of CVE-2022-2078. Notes: All CVE users should reference CVE-2022-2078 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
From the Ubuntu Security Team
Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets with multiple ranged fields. A local attacker could use this to cause a denial of service or execute arbitrary code.
Mitigation
If not needed, disable the ability for unprivileged users
to create namespaces:
$ sudo sysctl -w kernel.unprivileged_userns_clone=0
$ echo kernel.unprivileged_userns_clone=0 | \
sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf
Rejected
References
- https://www.openwall.com/lists/oss-security/2022/06/02/1
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=fecf31ee395b0295f2d7260aa29946b7605f7c85
- https://ubuntu.com/security/notices/USN-5468-1
- https://ubuntu.com/security/notices/USN-5469-1
- https://ubuntu.com/security/notices/USN-5470-1
- https://ubuntu.com/security/notices/USN-5471-1
- https://www.cve.org/CVERecord?id=CVE-2022-1972
- NVD
- Launchpad
- Debian