CVE-2022-0886

2022-03-1118:41:34

redhat.com

access.redhat.com

JSON

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

Mitigation

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection.

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:  
  
# echo "user.max_user_namespaces=0" &gt; /etc/sysctl.d/userns.conf  
# sysctl -p /etc/sysctl.d/userns.conf  
  
On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.