Out-of-bounds write in Linux kernel - CVE-2022-1015

Vulnerability identifier: #VU62027

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1015

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the nft_validate_register_store and nft_validate_register_load in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. A local user can escalate privileges on the system.

Linux kernel
Amazon Linux AMI
Slackware Linux
Ubuntu
openEuler
Oracle VM Server for x86
python3-perf
perf-debuginfo
kernel-tools-debuginfo
kernel-source
kernel-debuginfo
kernel-tools-devel
kernel-tools
python3-perf-debuginfo
kernel-headers
bpftool-debuginfo
perf
kernel-devel
bpftool
kernel-debugsource
kernel
linux-image-5.13.0-40-generic-64k (Ubuntu package)
linux-image-5.13.0-40-lowlatency (Ubuntu package)
linux-image-5.13.0-40-generic-lpae (Ubuntu package)
linux-image-5.13.0-40-generic (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.13.0-1021-kvm (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.13.0-1022-aws (Ubuntu package)
linux-image-5.13.0-1022-azure (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.13.0-1024-gcp (Ubuntu package)
linux-image-5.13.0-1025-raspi-nolpae (Ubuntu package)
linux-image-5.13.0-1025-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-5.13.0-1027-oracle (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-oem-20.04c (Ubuntu package)
linux-image-5.14.0-1033-oem (Ubuntu package)
linux-image-5.15.0-27-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-27-lowlatency (Ubuntu package)
linux-image-5.15.0-27-generic-lpae (Ubuntu package)
linux-image-5.15.0-27-generic (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-27-generic-64k (Ubuntu package)
linux-image-5.15.0-1003-ibm (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-5.15.0-1004-gcp (Ubuntu package)
linux-image-5.15.0-1006-raspi (Ubuntu package)
linux-image-5.15.0-1006-raspi-nolpae (Ubuntu package)
linux-5.15.38/kernel-huge
linux-5.15.38/kernel-generic
linux-5.15.38/kernel-headers
linux-5.15.38/kernel-modules

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

python3-perf - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
perf-debuginfo - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-tools-debuginfo - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-source - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-debuginfo - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-tools-devel - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-tools - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
python3-perf-debuginfo - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-headers - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
bpftool-debuginfo - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
perf - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-devel - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
bpftool - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel-debugsource - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
kernel - addressed in versions 5.10.0-60.91.0.115, 5.10.0-136.29.0.105
linux-image-5.13.0-40-generic-64k (Ubuntu package) - addressed in versions 5.13.0-40.45, 5.13.0-40.45~20.04.1
linux-image-5.13.0-40-lowlatency (Ubuntu package) - addressed in versions 5.13.0-40.45, 5.13.0-40.45~20.04.1
linux-image-5.13.0-40-generic-lpae (Ubuntu package) - addressed in versions 5.13.0-40.45, 5.13.0-40.45~20.04.1
linux-image-5.13.0-40-generic (Ubuntu package) - addressed in versions 5.13.0-40.45, 5.13.0-40.45~20.04.1
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.13.0.40.45~20.04.25
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.13.0.40.45~20.04.25
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.13.0.40.45~20.04.25
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.13.0.40.45~20.04.25
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.13.0.40.45~20.04.25
linux-image-lowlatency (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.15.0.27.28
linux-image-virtual (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.15.0.27.30
linux-image-generic-64k (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.15.0.27.30
linux-image-generic (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.15.0.27.30
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.14.0.1033.30, 5.15.0.27.30
linux-image-generic-lpae (Ubuntu package) - addressed in versions 5.13.0.40.49, 5.15.0.27.30
linux-image-kvm (Ubuntu package) - update to 5.13.0.1021.21
linux-image-5.13.0-1021-kvm (Ubuntu package) - update to 5.13.0-1021.22
linux-image-azure (Ubuntu package) - addressed in versions 5.13.0.1022.22, 5.13.0.1022.26~20.04.11
linux-image-aws (Ubuntu package) - addressed in versions 5.13.0.1022.23, 5.13.0.1022.24~20.04.15
linux-image-5.13.0-1022-aws (Ubuntu package) - addressed in versions 5.13.0-1022.24, 5.13.0-1022.24~20.04.1
linux-image-5.13.0-1022-azure (Ubuntu package) - addressed in versions 5.13.0-1022.26, 5.13.0-1022.26~20.04.1
linux-image-gke (Ubuntu package) - update to 5.13.0.1024.22
linux-image-gcp (Ubuntu package) - addressed in versions 5.13.0.1024.22, 5.13.0.1024.29~20.04.1, 5.15.0.1004.5
linux-image-5.13.0-1024-gcp (Ubuntu package) - addressed in versions 5.13.0-1024.29, 5.13.0-1024.29~20.04.1
linux-image-5.13.0-1025-raspi-nolpae (Ubuntu package) - update to 5.13.0-1025.27
linux-image-5.13.0-1025-raspi (Ubuntu package) - update to 5.13.0-1025.27
linux-image-raspi-nolpae (Ubuntu package) - addressed in versions 5.13.0.1025.30, 5.15.0.1006.6
linux-image-raspi (Ubuntu package) - addressed in versions 5.13.0.1025.30, 5.15.0.1006.6
linux-image-oracle (Ubuntu package) - addressed in versions 5.13.0.1027.27, 5.13.0.1027.32~20.04.1
linux-image-5.13.0-1027-oracle (Ubuntu package) - addressed in versions 5.13.0-1027.32, 5.13.0-1027.32~20.04.1
linux-image-oem-20.04b (Ubuntu package) - update to 5.14.0.1033.30
linux-image-oem-20.04d (Ubuntu package) - update to 5.14.0.1033.30
linux-image-oem-20.04c (Ubuntu package) - update to 5.14.0.1033.30
linux-image-5.14.0-1033-oem (Ubuntu package) - update to 5.14.0-1033.36
linux-image-5.15.0-27-lowlatency-64k (Ubuntu package) - update to 5.15.0-27.28
linux-image-5.15.0-27-lowlatency (Ubuntu package) - update to 5.15.0-27.28
linux-image-5.15.0-27-generic-lpae (Ubuntu package) - update to 5.15.0-27.28
linux-image-5.15.0-27-generic (Ubuntu package) - update to 5.15.0-27.28
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.27.28
linux-image-5.15.0-27-generic-64k (Ubuntu package) - update to 5.15.0-27.28
linux-image-5.15.0-1003-ibm (Ubuntu package) - update to 5.15.0-1003.3
linux-image-ibm (Ubuntu package) - update to 5.15.0.1003.4
linux-image-5.15.0-1004-gcp (Ubuntu package) - update to 5.15.0-1004.7
linux-image-5.15.0-1006-raspi (Ubuntu package) - update to 5.15.0-1006.6
linux-image-5.15.0-1006-raspi-nolpae (Ubuntu package) - update to 5.15.0-1006.6
linux-5.15.38/kernel-huge - update to 5.15.38
linux-5.15.38/kernel-generic - update to 5.15.38
linux-5.15.38/kernel-headers - update to 5.15.38
linux-5.15.38/kernel-modules - update to 5.15.38
kernel - update to 6.1.10-15.42

• Exploit #9301 - CVE-2022-1015 (Linux Kernel 1-Day Analysis & Exploitation) (September 8, 2023)
• Exploit #8599 - CVE-2022-1015 (A write-up and LPE PoC of an OOB read and write vulnerability in the Linux Kernel.) (November 13, 2022)
• Exploit #8223 - bob_kern_exp1 (CVE-2022-1015) (August 7, 2022)
• Exploit #7621 - CVE-2022-1015 (Local privilege escalation PoC for Linux kernel CVE-2022-1015) (April 8, 2022)

• https://bugzilla.redhat.com/show_bug.cgi?id=2065323

• Privilege escalation in Linux kernel NFT
• Amazon Linux AMI update for kernel
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux-raspi
• Ubuntu update for linux-oem-5.14
• Slackware Linux update for Slackware 15.0 kernel
• Multiple vulnerabilities in Oracle VM Server for x86
• openEuler 22.03 LTS SP1 update for kernel
• openEuler 22.03 LTS update for kernel
• Amazon Linux AMI update for kernel