Loading vulnerability…
Local Privilege Escalation in Linux Kernel IPsec ESP Transformation
CVE-2022-27666 is a heap-based buffer overflow in the Linux kernel's IPv4 and IPv6 IPsec Encapsulating Security Payload (ESP) transformation implementation. A local attacker with normal user privileges can trigger the overflow with a large message and overwrite kernel heap objects, potentially escalating privileges. Exploitability depends on access to an IPsec security association, either already configured or created using appropriate network administration capabilities.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt kernel heap memory and potentially escalate a local low-privileged user's privileges, compromising system confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 base score of 7.8 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
If you can’t patch tonight, do this now.
On non-containerized RHEL 8 systems, disable unprivileged user namespaces by setting user.max_user_namespaces to 0 to prevent unprivileged attackers from obtaining the capabilities needed to configure an IPsec security association. Do not apply this mitigation to containerized deployments such as OpenShift that require user namespaces. This measure does not eliminate exposure when an exploitable IPsec security association is already configured.
Patch, then assume compromise.
Install a vendor-supported kernel update addressing CVE-2022-27666, or upgrade upstream Linux to version 5.16.15 or a later release containing the fix. Fixed distribution builds include RHEL 8 kernel 4.18.0-372.13.1.el8_6, RHEL 8.4 EUS kernel 4.18.0-305.49.1.el8_4, and RHEL 8.2 EUS kernel 4.18.0-193.87.1.el8_2. Reboot after installing conventional kernel updates. Supported RHEL deployments can alternatively apply the appropriate vendor kpatch live-patch update for their running kernel.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.