CVE-2022-1966

一、漏洞信息
 漏洞编号：[CVE-2022-1966](https://nvd.nist.gov/vuln/detail/CVE-2022-1966)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：3.12,4.19.140,4.19.194,4.19.90,5.10.0
 CVSS V3.0分值：
  BaseScore：8.4 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
 漏洞公开时间：2022-06-07 02:15
 漏洞创建时间：2022-06-07 16:19:57
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-1966
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://access.redhat.com/security/cve/CVE-2022-1966 |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L4300
static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
                            const struct nlattr * const nla[] |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L4464
    set = kvzalloc(alloc_size, GFP_KERNEL |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L4511
    if (nla[NFTA_SET_EXPR] |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L5404
struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
                     const struct nft_set *set,
                     const struct nlattr *attr |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L2918
void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nft_lookup.c#L18
struct nft_lookup {
    struct nft_set * set;
    u8 sreg;
    u8 dreg;
    bool invert;
    struct nft_set_binding binding;
};
```

and

```cpp
//https://elixir.bootlin.com/linux/latest/source/include/net/netfilter/nf_tables.h#L576
/**
 *    struct nft_set_binding - nf_tables set binding
 *
 *    @list: set bindings list node
 *    @chain: chain containing the rule bound to the set
 *    @flags: set action flags
 *
 *    A set binding contains all information necessary for validation
 *    of new elements added to a bound set.
 */
struct nft_set_binding {
    struct list_head list;
    const struct nft_chain * chain;
    u32 flags;
};
```

IT `nft_lookup_init` function looks up a referenced set that must already
exist, and if it is found then the lookup expression will be bound to that set:

```cpp
//https://elixir.bootlin.com/linux/latest/source/net/netfilter/nft_lookup.c#L101
    struct nft_set *set;
    u32 flags;
    int err;

if (tb[NFTA_LOOKUP_SET] == NULL ||
        tb[NFTA_LOOKUP_SREG] == NULL |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L4701
int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
               struct nft_set_binding *binding |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L5404
struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
                                         const struct nft_set *set,
                                         const struct nlattr *attr |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L2918
void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c#L2856
static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
                                   struct nft_expr *expr |  |
| suse_bugzilla | https://elixir.bootlin.com/linux/latest/source/net/netfilter/nft_lookup.c#L267
static const struct nft_expr_ops nft_lookup_ops = {
    [...]
    .destroy    = nft_lookup_destroy,
```

It tries to call a destruction routine on the associated set that was bound:

From: `nft_lookup.c`:

```cpp
//https://elixir.bootlin.com/linux/latest/source/net/netfilter/nft_lookup.c#L173
static void nft_lookup_destroy(const struct nft_ctx *ctx,
                               const struct nft_expr *expr |  |
| suse_bugzilla | https://lore.kernel.org/netdev/20220526205411.315136-1-pablo@netfilter.org/T/#me63442c24b77995357c04a117eceeede13eb2f24 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2022-1966 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.10.120 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ea62d169b6e731e0b54abda1d692406f6bc6a696 |  | linuxkernelcves |
| linux_kernel | 5.15.45 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=f692bcffd1f2ce5488d24fbcb8eab5f351abf79d |  | linuxkernelcves |
| linux_kernel | 5.17.13 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=d8db0465bcc4d4b54ecfb67b820ed26eb1440da7 |  | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        A use-after-free vulnerability was found in the Linux kernel s Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue.   
 openEuler评分：
  8.4
 Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS:受影响
2.openEuler-20.03-LTS-SP1(4.19.90):受影响
3.openEuler-20.03-LTS-SP3(4.19.90):受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-22.03-LTS:否
2.openEuler-20.03-LTS-SP1(4.19.90):否
3.openEuler-20.03-LTS-SP3(4.19.90):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2022-1725

src-openEuler/kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-1966

Comments (11)

Search

src-openEuler/kernel
Closed