7.8
CVSSv3

CVE-2022-25636

Published: 24/02/2022 Updated: 09/11/2023
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 616
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 up to and including 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

debian debian linux 11.0

netapp h300s -

netapp h500s -

netapp h700s -

netapp h300e -

netapp h500e -

netapp h700e -

netapp h410s -

netapp h410c -

oracle communications cloud native core binding support function 22.1.3

oracle communications cloud native core policy 22.2.0

oracle communications cloud native core network exposure function 22.1.1

Vendor Advisories

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2020-36310 A flaw was discovered in the KVM implementation for AMD processors, which could lead to an infinite loop A malicious VM guest could exploit this to cause a denial of service ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Synopsis Moderate: Red Hat OpenShift Logging Security and Bug update Release 537 Type/Severity Security Advisory: Moderate Topic Openshift Logging Bug Fix Release (537)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed seve ...
Synopsis Moderate: Red Hat OpenShift Logging Security and Bug update Release 541 Type/Severity Security Advisory: Moderate Topic Logging Subsystem 541 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed se ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 171 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 171 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis Moderate: Openshift Logging Security and Bug update Release (5210) Type/Severity Security Advisory: Moderate Topic Openshift Logging Bug Fix Release (5210)Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detai ...
Synopsis Moderate: Red Hat Advanced Cluster Management 244 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 244 GeneralAvailability release images This update provides security fixes, bug fixes, and updates container imagesRed Hat Product Security has rated ...
Synopsis Moderate: OpenShift Container Platform 4750 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4750 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Platfo ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat P ...
Synopsis Moderate: Red Hat Advanced Cluster Management 2310 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 2310 GeneralAvailability release images, which provide security updates and bug fixesRed Hat Product Security has rated this update as having a secur ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product Security has rated this ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product S ...
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_apic of the netfilter subsystem This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015) A flaw was found in the Linux kernel in net/netfilter/nf_tables_corec:nft_do_chain, which can cause a use-after-free This issue needs to handle return with pro ...
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_apic of the netfilter subsystem This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015) A flaw was found in the Linux kernel in net/netfilter/nf_tables_corec:nft_do_chain, which can cause a use-after-free This issue needs to handle return with pro ...
An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in net/netfilter/nf_dup_netdevc in the netfilter subcomponent in the Linux kernel due to a heap out-of-bounds write problem This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a pri ...
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_apic of the netfilter subsystem This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015) A flaw was found in the Linux kernel in net/netfilter/nf_tables_corec:nft_do_chain, which can cause a use-after-free This issue needs to handle return with pro ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: Linux kernel: heap out of bounds write in nf_dup_netdevc since 54 <!--X-Subject-Header-End--> <!--X-Head-of-Message--> ...

Github Repositories

Robin on Rails: my notes about technology and some other knowledge.

Robin on Rails: Track My Study of Various Software/Hardware Technologies (Last updated on 2022-11-20) 1 Overview Is it possible to keep track of the latest development of every technology in the software development industry? No Impossible nowadays A lot of people will say: Don't try! Being a programmer requires continuous learning of various technologies However, as t

CVE-2022-0185 analysis write up

CVE-2022-25636 netfilter内核提权 [toc] 漏洞简介 漏洞编号: CVE-2022-25636 漏洞产品: linux kernel - netfilter 影响版本: linux kernel 54 ~ 漏洞危害: netfilter 内核模块中存在堆越界写,存在SYS_ADMIN时可以造成提权 环境搭建 漏洞存在于netfilter 内核模块中,漏洞所在代码在3个ko 中。 nft_dup_netdevko nf_dup_netdevk

CVE-2022-25636 exploit rewritten with pipe primitive

CVE-2022-25636 pipe version Using pipe-primitive to exploit CVE-2022-25636, so no kaslr leak nor smap smep ktpi bypass is needed :) (Q: What is pipe-primitive? A: githubcom/veritas501/pipe-primitive)

Make your code extra-safe by voluntarily dropping privileges

extrasafe "trust noone not even urself" - internet man fn main() { println!("disabling syscalls"); extrasafe::SafetyContext::new() enable( extrasafe::builtins::SystemIO::nothing() allow_stdout() allow_stderr() )unwrap() apply_to_all_threads()unwrap(); // Opening files now fail

Awesome List of my own!

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents Brainfuck C C# C++ CMake CSS CoffeeScript Dart Dockerfile Go HTML Handlebars Java JavaScript Jupyter Notebook Kotlin Lua Makefile Markdown Mercury Objective-C Others PHP Pascal Python QML Roff Ruby Rust SCSS Shell Stylus Swift TypeScript Vala Vue Brainfuck kiddin9/OpenWrt_x86-r2s-r4s-r5s-N1 -

CVE-2022-25636

CVE-2022-25636 This is my exploit for CVE-2022-25636 I tested it against Ubuntu 2110 with kernel 5130-30 Works about ~40% of the time, in the other cases you likely get a kernel panic The exploit might corrupt important data on heap, after an unsuccessful attempt it's best to reboot