News for hackers. Stuff that matters.

A comment on Linux kernel use-after-free in Netfilter, local privilege escalation. Parent comment

Re:Linux kernel use-after-free in Netfilter, local privilege... by pizzalife on Tuesday May 09, 2023 @06:28PM (#35881173)
> but the specific module in question in the patch, nf_tables, is not loaded on my Ubuntu 20.04LTS 5.40 kernel running iptables/ufw at least

This doesn't matter since Linux has autoloading of most network modules, and you can cause the modules to be loaded on Ubuntu since it supports unprivileged user/net namespaces.

  ubuntu:~% grep DISTRIB_DESCRIPTION /etc/lsb-release
  DISTRIB_DESCRIPTION="Ubuntu 22.04.2 LTS"
  ubuntu:~% lsmod|grep nf_table
  ubuntu:~% unshare -U -m -n -r
  ubuntu:~% nft add table inet filter
  ubuntu:~% lsmod|grep nf_table
  nf_tables             249856  0
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by veonik on Tuesday May 09, 2023 @07:58PM (#35881919)
Yikes... are other popular distros shipping with unprivileged user namespaces enabled by default?
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by galangalalgol on Tuesday May 09, 2023 @08:33PM (#35882166)
That is part of enabling rootless containers on rhel or similar.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by waynesonfire on Tuesday May 09, 2023 @10:22PM (#35882895)
should have re-written it in rust.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by yjftsjthsd-h on Wednesday May 10, 2023 @01:35AM (#35884008)
Rewritten what? The container runtime will need the same access regardless of what it's written in, and rewriting all of Linux (the kernel) would be... ambitious, although it is adopting rust incrementally.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by scns on Wednesday May 10, 2023 @08:09AM (#35886194)
The good old Strangler Pattern.

https://martinfowler.com/bliki/StranglerFigApplication.html

[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by galangalalgol on Wednesday May 10, 2023 @08:31AM (#35886400)
Some of the issue though is that a monolithic kernel provides more access than necessary to many things. When they made the locks granular, those might be reasonable boundaries for permissions? At this point I'd rather figure out how to make windows drivers work in redox or something crazy like that.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by failsecure on Tuesday May 09, 2023 @11:22PM (#35883271)
Yes and this decision haunts distros like Ubuntu over and over again. There's no easy win though.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by marcthe12 on Wednesday May 10, 2023 @12:09AM (#35883552)
Most, I think Debian has patch to be disabled at runtime via sysctl. The reason is that most containers or sandboxing techniques are root only unless you mix it with user namescapes. So most container or sandbox software use suid(firejail) , root daemon(docker) or user namescapes (podman and flatpak). Looking at the cves, user namespaces is probably the safer option
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by touisteur on Wednesday May 10, 2023 @02:20AM (#35884258)
Do you need a user namespace? I'd expect a network namespace to be enough. Am I missing something?
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by jwilk on Wednesday May 10, 2023 @02:48AM (#35884416)
You need CAP_SYS_ADMIN to create a new network namespace.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by TacticalCoder on Wednesday May 10, 2023 @07:22AM (#35885924)
For comparison, on my Debian Bookworm (aka "testing" but in hard freeze and full freeze in a few days I think, stable release in june) here...

    ...$  lsmod|grep nf_table    (tried without any just to make sure) 
    ...$  unshare -U -m -n -r
    unshare: unshare: failed: Operation not permitted
    ...$  /sbin/nft add table inet filter
    Error: Could not process rule: Operation not permitted
    add table inet filter
    ^^^^^^^^^^^^^^^^^^^^^^

    root #  cat /proc/sys/kernel/unprivileged_userns_clone
    0
[ Parent | on HN ]