PT-2022-2565 · Linux+9 · Linux Kernel+9

Jann Horn · Publicado 2022-04-08 · Atualizado 2023-08-14 · CVE-2022-30594

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Nome do software vulnerável e versões afetadas

Versões do kernel Linux anteriores à 5.17.2

Descrição

O problema está relacionado ao tratamento incorreto das permissões seccomp no kernel Linux. Especificamente, o caminho de código PTRACE SEIZE permite que invasores contornem as restrições previstas ao definir o sinalizador PT SUSPEND SECCOMP. Isso pode permitir que um invasor eleve seus privilégios.

Recomendações

Para versões do kernel Linux anteriores à 5.17.2, atualize para a versão 5.17.2 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o uso do caminho de código PTRACE SEIZE para minimizar o risco de exploração.

Exploit

Correção

Incorrect Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-863

CWE-275

CWE-862

Identificadores relacionados

ALSA-2022:7318

ALSA-2022:7319

ALSA-2023:0300

ALSA-2023:0334

ALSA-2023:2736

ALSA-2023:2951

ALT-PU-2022-1656

ALT-PU-2022-1657

ALT-PU-2022-1678

ALT-PU-2022-1679

ALT-PU-2022-1680

ALT-PU-2022-1688

ALT-PU-2022-1713

ALT-PU-2022-1730

ALT-PU-2022-1746

ALT-PU-2022-1833

ALT-PU-2022-1880

ALT-PU-2022-1881

ALT-PU-2022-1907

ALT-PU-2022-2152

ALT-PU-2022-2155

ALT-PU-2022-2344

ALT-PU-2022-2957

ALT-PU-2023-4894

AZL-9747

BDU:2022-03004

CESA-2023_2736

CESA-2023_2951

CVE-2022-30594

DLA-3065-1

DSA-5173-1

LSN-0086-1

OESA-2022-1705

OPENSUSE-SU-2022:2177-1

OPENSUSE-SU-2022_2078-1

OPENSUSE-SU-2022_2079-1

OPENSUSE-SU-2022_2111-1

OPENSUSE-SU-2022_2520-1

OPENSUSE-SU-2022_2615-1

RHSA-2022:7318

RHSA-2022:7319

RHSA-2022_7318

RHSA-2022_7319

RHSA-2023:0300

RHSA-2023:0334

RHSA-2023:2736

RHSA-2023:2951

RHSA-2023_0300

RHSA-2023_0334

RHSA-2023_2736

RHSA-2023_2951

RHSA-2024:0412

RLSA-2022:7318

RLSA-2022:7319

RLSA-2023:0300

RLSA-2023:0334

RXSA-2023:0334

SUSE-SU-2022:1939-1

SUSE-SU-2022:1940-1

SUSE-SU-2022:1942-1

SUSE-SU-2022:1945-1

SUSE-SU-2022:1947-1

SUSE-SU-2022:1948-1

SUSE-SU-2022:1949-1

SUSE-SU-2022:1955-1

SUSE-SU-2022:1974-1

SUSE-SU-2022:1988-1

SUSE-SU-2022:2000-1

SUSE-SU-2022:2006-1

SUSE-SU-2022:2010-1

SUSE-SU-2022:2077-1

SUSE-SU-2022:2078-1

SUSE-SU-2022:2079-1

SUSE-SU-2022:2080-1

SUSE-SU-2022:2082-1

SUSE-SU-2022:2083-1

SUSE-SU-2022:2103-1

SUSE-SU-2022:2104-1

SUSE-SU-2022:2111-1

SUSE-SU-2022:2116-1

SUSE-SU-2022:2177-1

SUSE-SU-2022:2268-1

SUSE-SU-2022:2520-1

SUSE-SU-2022:2615-1

SUSE-SU-2022:2629-1

SUSE-SU-2022_1949-1

SUSE-SU-2022_1988-1

SUSE-SU-2022_2010-1

USN-5442-1

USN-5442-2

USN-5443-1

USN-5443-2

USN-5465-1

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Rocky Linux

Suse

Ubuntu

Referências · 697

• 🔥 https://bugs.chromium.org/p/project-zero/issues/detail?id=2276 · Exploit
• https://github.com/torvalds/linux/commit/ee1fee900537b5d9560e9f937402de5ddc8412f3 · Correção
• https://bugzilla.suse.com/1197016 · Nota
• https://access.redhat.com/errata/RHSA-2022:7319 · Nota
• https://suse.com/security/cve/CVE-2022-1998 · Nota
• https://bugzilla.suse.com/1200692 · Nota
• https://bugzilla.suse.com/1196840 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2141752 · Nota
• https://bugzilla.suse.com/1189998 · Nota
• https://bugzilla.suse.com/1199918 · Nota
• https://bugzilla.suse.com/1198826 · Nota
• https://access.redhat.com/security/cve/CVE-2023-0394 · Nota
• https://bugzilla.suse.com/1200762 · Nota
• https://bugzilla.suse.com/1200827 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2022:2078-1 · Aviso do Fabricante