CVE-2022-2078

Published: 30 June 2022

A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code.

From the Ubuntu Security Team

It was discovered that the netfilter subsystem in the Linux kernel contained a buffer overflow in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

CVE-2022-1972 is a duplicate of this issue
fixes ZDI-CAN-17464

Mitigation

If not needed, disable the ability for unprivileged users
to create namespaces:
  $ sudo sysctl -w kernel.unprivileged_userns_clone=0
  $ echo kernel.unprivileged_userns_clone=0 | \
    sudo tee /etc/sysctl.d/99-disable-unpriv-userns.conf

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2078
• https://git.kernel.org/linus/fecf31ee395b0295f2d7260aa29946b7605f7c85 (5.19-rc1)
• https://ubuntu.com/security/notices/USN-5529-1
• NVD
• Launchpad
• Debian