CVE-2022-20368

An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets (AF_PACKET) used PACKET_COPY_THRESH and mmap operations. A local attacker with CAP_NET_RAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege escalation.

Only local users with CAP_NET_RAW capability enabled can trigger this issue. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be gained by exploiting unprivileged user namespaces.

In a default or common use of Red Hat Enterprise Linux 7 unprivileged user namespaces are disabled by default, so local unprivileged users cannot abuse namespaces to grant themselves the CAP_NET_RAW capability and potentially elevate their privileges on the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The mitigation is to disable CAP_NET_RAW capability for regular users and executables to prevent access to raw packet sockets (AF_PACKET). On Red Hat Enterprise Linux 8, the mitigation is to either disable unprivileged user namespaces with sysctl -w user.max_user_namespaces=0 or network namespaces with sysctl -w user.max_net_namespaces=0. For more information on how to set sysctl variables on Red Hat Enterprise Linux, please refer to https://access.redhat.com/solutions/2587.