CVE-2022-25636
published 2022-02-24CVE-2022-25636: net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is…
PriorityP347high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
2.63%
83.8th percentile
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 5.16.11-1 (bookworm) | linux 5.16.11-1 (bookworm) |
| linux | linux_kernel | >= 0 < 5.10.103-1 | 5.10.103-1 |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 0 < 5.4.0-104.118 | 5.4.0-104.118 |
| linux | linux_kernel | >= 0 < 4.4.0-222.255 | 4.4.0-222.255 |
| linux | linux_kernel | >= 0 < 4.15.0-173.182 | 4.15.0-173.182 |
| linux | linux_kernel | >= 0 < 5.4.0-105.119 | 5.4.0-105.119 |
| linux | linux_kernel | >= 5.11 < 5.15.26 | 5.15.26 |
| linux | linux_kernel | >= 5.16 < 5.16.12 | 5.16.12 |
| linux | linux_kernel | >= 5.4 < 5.4.182 | 5.4.182 |
| linux | linux_kernel | >= 5.5 < 5.10.103 | 5.10.103 |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_network_exposure_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_oracle7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Kernel
security, lsm: Introduce security_create_user_ns()
kernel_security·2022-08-15
CVE-2022-0492 security, lsm: Introduce security_create_user_ns()
security, lsm: Introduce security_create_user_ns()
User namespaces are an effective tool to allow programs to run with
permission without requiring the need for a program to run as root. User
namespaces may also be used as a sandboxing technique. However, attackers
sometimes leverage user namespaces as an initial attack vector to perform
some exploit. [1,2,3]
While it is not the unprivileged user namespace functionality, which
causes the kernel to be exploitable, users/administrators might want to
more granularly limit or at least monitor how various processes use this
functionality, while vulnerable kernel subsystems are being patched.
Preventing user namespace already creation comes in a few of forms in
order of granularity:
1. /proc/sys/user/max_user_namespaces sysctl
2. Distro spec
OSV
linux-intel-5.13 vulnerabilities
osv·2022-04-01·CVSS 6.5
CVE-2022-25636 [MEDIUM] linux-intel-5.13 vulnerabilities
linux-intel-5.13 vulnerabilities
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-2022-23960)
It was discovered that the BPF verifier in the Linux kernel did not
properly restrict pointer types in certain situations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2022-23222)
Max Kellerm
OSV
Kernel Live Patch Security Notice
osv·2022-03-23·CVSS 7.8
CVE-2022-0492 [HIGH] Kernel Live Patch Security Notice
Kernel Live Patch Security Notice
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the
Linux kernel did not properly restrict access to the cgroups v1
release_agent feature. A local attacker could use this to gain
administrative privileges.(CVE-2022-0492)
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code.(CVE-2022-25636)
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-
osv·2022-03-09·CVSS 6.5
[MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-20
OSV
linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oem-5.14, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities
osv·2022-03-09·CVSS 6.5
CVE-2022-25636 [MEDIUM] linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oem-5.14, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities
linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oem-5.14, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-2022-23960)
Max Kellermann discovered that the Linux kernel incorrectly handled Unix
pipes. A local attacker coul
GHSA
GHSA-44m9-c2jp-x4c5: net/netfilter/nf_dup_netdev
ghsa_unreviewed·2022-02-25
CVE-2022-25636 [HIGH] CWE-269 GHSA-44m9-c2jp-x4c5: net/netfilter/nf_dup_netdev
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
OSV
CVE-2022-25636: net/netfilter/nf_dup_netdev
osv·2022-02-24·CVSS 7.8
CVE-2022-25636 [HIGH] CVE-2022-25636: net/netfilter/nf_dup_netdev
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Oracle
Oracle Oracle Communications Risk Matrix: Oracle Linux — CVE-2022-25636
vendor_oracle·2022-07-15·CVSS 7.8
CVE-2022-25636 [HIGH] Oracle Oracle Communications Risk Matrix: Oracle Linux — CVE-2022-25636
Oracle Oracle Communications Risk Matrix: Oracle Linux vulnerability
CVE: CVE-2022-25636
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2022 (JUL 2022)
Ubuntu
Linux kernel (Intel IOTG) vulnerabilities
vendor_ubuntu·2022-04-01·CVSS 6.5
CVE-2022-0742 [MEDIUM] Linux kernel (Intel IOTG) vulnerabilities
Title: Linux kernel (Intel IOTG) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-2022-23960)
It was discovered that the BPF verifier in the Linux kernel did not
properly restrict pointer types in certain situations. A local attacker
could use this to cause a denial of servic
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2022-03-23·CVSS 7.8
CVE-2022-0492 [HIGH] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the
Linux kernel did not properly restrict access to the cgroups v1
release_agent feature. A local attacker could use this to gain
administrative privileges.(CVE-2022-0492)
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code.(CVE-2022-25636)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-03-09·CVSS 6.5
CVE-2022-25636 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-2022-23960)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by Intel to their
processors to address Spectre-BTI were insufficient
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-03-09·CVSS 6.5
CVE-2022-23960 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2022-25636)
Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano
Giuffrida discovered that hardware mitigations added by ARM to their
processors to address Spectre-BTI were insufficient. A local attacker could
potentially use this to expose sensitive information. (CVE-2022-23960)
Max Kellermann discovered that the Linux kernel incorrectly handled Unix
pipes. A local attacker could potentially use this to modify any file that
could be opened for reading. (CVE-2022-0847)
E
Red Hat
kernel: heap out of bounds write in nf_dup_netdev.c
vendor_redhat·2022-02-22·CVSS 7.8
CVE-2022-25636 [HIGH] CWE-787 kernel: heap out of bounds write in nf_dup_netdev.c
kernel: heap out of bounds write in nf_dup_netdev.c
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in net/netfilter/nf_dup_netdev.c in the netfilter subcomponent in the Linux kernel due to a heap out-of-bounds write problem. This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat.
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 8.3 GA onwards. Previous Red Hat Enterprise Linux versions are not affected.
Mitigation
Debian
CVE-2022-25636: linux - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows loca...
vendor_debian·2022·CVSS 7.8
CVE-2022-25636 [HIGH] CVE-2022-25636: linux - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows loca...
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
Scope: local
bookworm: resolved (fixed in 5.16.11-1)
bullseye: resolved (fixed in 5.10.103-1)
forky: resolved (fixed in 5.16.11-1)
sid: resolved (fixed in 5.16.11-1)
trixie: resolved (fixed in 5.16.11-1)
No detection rules found.
No public exploits indexed.
arXiv
BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS
arxiv_fulltext·2024-09-15
BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS
BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS-1em
Yinggang Guo12,
Zicheng Wang1,
Weiheng Bai2,
Qingkai Zeng1 and
Kangjie Lu2
1State Key Laboratory for Novel Software Technology, Nanjing University, 2University of Minnesota
\gyg, wzc\@smail.nju.edu.cn, [email protected], [email protected], [email protected]
\@IEEEpubidpullup6.5
Network and Distributed System Security (NDSS) Symposium 2025
23 - 28 February 2025, San Diego, CA, USA
ISBN 979-8-9894372-8-3
https://dx.doi.org/10.14722/ndss.2025.23328
www.ndss-symposium.org
[ ]
## Abstract
The endless stream of vulnerabilities urgently calls for principled mitigation to confine the effect of exploitation. However, the monolithic architecture of commodity OS kernels, like the Linux kernel, allows an attacker to co
arXiv
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
arxiv_fulltext·2024-09-07
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
Jinmeng Zhou, Jiayi Hu, Ziyue Pan, Jiaxun Zhu, Wenbo Shen, Guoren Li, Zhiyun Qian
Jinmeng Zhou, Jiayi Hu, Ziyue Pan, Jiaxun Zhu and Wenbo Shen are with the College of Computer Science and Technology at Zhejiang University, Hangzhou, Zhejiang, 310027, China.
Email: \jinmengzhou, hujiayi, ziyuepan, sevenswords, shenwenbo\@zju.edu.cn;
Guoren Li and Zhiyun Qian are with the Department of Computer Science and Engineering, University of California, Riverside 92521, USA.
Email: [email protected] and [email protected];
Wenbo Shen is the corresponding author.
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. XX, 20XX
Shell et al.: A Sample Article Using IEEEtran.cls for IEEE Journals
## Abstra
arXiv
One for All and All for One: GNN-based Control-Flow Attestation for Embedded Devices
arxiv_fulltext·2024-03-12
One for All and All for One: GNN-based Control-Flow Attestation for Embedded Devices
One for All and All for One:\ -based Control-Flow Attestation for Embedded Devices
Marco Chilese1, Richard Mitev1, Meni Orenbach2,
Robert Thorburn3, Ahmad Atamli23, Ahmad-Reza Sadeghi1 5px
1Technical University of Darmstadt, 2NVIDIA, 3 University of Southampton
## Abstract
Control-Flow Attestation (CFA) is a security service that allows an entity (verifier) to verify the integrity of code execution on a remote computer system (prover). Existing CFA schemes suffer from impractical assumptions, such as requiring access to the prover's internal state (e.g., memory or code), the complete Control-Flow Graph (CFG) of the prover's software, large sets of measurements, or tailor-made hardware. Moreover, current CFA schemes are inadequate for attesting embedded systems due to their high computat
http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.htmlhttp://www.openwall.com/lists/oss-security/2022/02/22/1https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=b1a5983f56e371046dcf164f90bfaf704d2b89f6https://github.com/Bonfee/CVE-2022-25636https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/https://security.netapp.com/advisory/ntap-20220325-0002/https://www.debian.org/security/2022/dsa-5095https://www.openwall.com/lists/oss-security/2022/02/21/2https://www.oracle.com/security-alerts/cpujul2022.htmlhttp://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.htmlhttp://www.openwall.com/lists/oss-security/2022/02/22/1https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=b1a5983f56e371046dcf164f90bfaf704d2b89f6https://github.com/Bonfee/CVE-2022-25636https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/https://security.netapp.com/advisory/ntap-20220325-0002/https://www.debian.org/security/2022/dsa-5095https://www.openwall.com/lists/oss-security/2022/02/21/2https://www.oracle.com/security-alerts/cpujul2022.html
2022-02-24
Published