An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges a different vulnerability than CVE-2022-32250. (The attacker can obtain root access but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

🗓️ 14 Jul 2022 07:00:00Reported by MicrosoftType

Linux kernel up to 5.18.9 has a type confusion in nft_set_elem_init that enables local privilege escalation.

Reporter	Title	Published	Views	Family All 750
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data has a vulnerable base OS image due to kernel-headers ( CVE-2022-1012, CVE-2022-32250 )	3 Feb 202523:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux Kernel, Golang Go, and cURL libcurl may affect IBM Spectrum Protect Plus	13 Dec 202219:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Linux Kernel and OpenSSL may affect IBM Spectrum Copy Data Management	17 Sep 202201:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9	8 Dec 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	24 Oct 202220:10	–	ibm
GithubExploit	Exploit for Use After Free in Linux Linux_Kernel	15 Jun 202303:27	–	githubexploit
GithubExploit	Exploit for Use After Free in Linux Linux_Kernel	24 Aug 202206:00	–	githubexploit
GithubExploit	Exploit for Use After Free in Linux Linux_Kernel	6 Dec 202413:49	–	githubexploit
GithubExploit	Exploit for Type Confusion in Linux Linux_Kernel	24 Jul 202214:47	–	githubexploit