CVE-2022-20368

An out-of-bounds access issue was found in the Linux kernel networking subsystem in the way raw packet sockets (AF_PACKET) used PACKET_COPY_THRESH and mmap operations. A local attacker with CAP_NET_RAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or privilege escalation.

Mitigation

The mitigation is to disable CAP_NET_RAW capability for regular users and executables to prevent access to raw packet sockets (AF_PACKET). On Red Hat Enterprise Linux 8, the mitigation is to either disable unprivileged user namespaces with sysctl -w user.max_user_namespaces=0 or network namespaces with sysctl -w user.max_net_namespaces=0. For more information on how to set sysctl variables on Red Hat Enterprise Linux, please refer to <https://access.redhat.com/solutions/2587&gt;.