Linux Kernel Dm-verity authentication bypass by assumed-immutable data

Summaryinfo

A vulnerability has been found in Linux Kernel and classified as critical. Affected by this issue is some unknown functionality of the component Dm-verity. This manipulation causes authentication bypass by assumed-immutable data. This vulnerability is handled as CVE-2022-2503. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Linux Kernel (Operating System) (the affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown part of the component Dm-verity. The manipulation with an unknown input leads to a authentication bypass by assumed-immutable data vulnerability. The CWE definition for the vulnerability is CWE-302. The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5

The weakness was released 08/12/2022 as GHSA-6vq3-w69p-w63m. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2022-2503 since 07/21/2022. The technical details are unknown and an exploit is not publicly available.

Applying the patch 4caae58406f8ceb741603eee460d79bacca9b1b5 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion