Listen to this Post
The vulnerability resides in the net/netfilter/x_tables.c component. It is a heap out-of-bounds write flaw in the `xt_compat_target_from_user` function. The issue arises when processing 32-bit rulesets on 64-bit systems. The code miscalculates the target size for certain extensions, specifically not accounting for the full padding required for alignment. This leads to writing the `target_size` value beyond the allocated heap buffer’s end. By carefully crafting a malicious ruleset, an attacker can corrupt adjacent heap memory. This corruption can be leveraged to overwrite critical kernel structures, leading to privilege escalation from a regular user to root or causing a denial-of-service (kernel crash).
Platform: Linux Kernel
Version: v2.6.19-rc1+
Vulnerability: Heap OOB Write
Severity: Critical
date: 2021-07-20
Prediction: 2021-07-27
What Undercode Say:
uname -r iptables -L cat /proc/sys/kernel/unprivileged_userns_clone
//PoC code structure ret = setsockopt(sock, SOL_IP, IPT_SO_SET_REPLACE, &data, sizeof(data));
How Exploit:
Craft malicious iptables rule.
Trigger via setsockopt call.
Overwrite kernel structures.
Achieve root privileges.
Protection from this CVE
Update kernel version.
Disable user namespaces.
Apply vendor patches.
Impact:
Privilege Escalation
Denial of Service
Kernel Memory Corruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
