Incorrect authorization in Linux kernel - CVE-2022-20572

Vulnerability identifier: #VU74549

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20572

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a missing permission check within the verity_target() function in dm-verity-target.c. A local user can modify read-only files and escalate privileges on the system.

Linux kernel
Anolis OS
Ubuntu
openEuler
linux-image-4.4.0-1155-aws (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-1118-kvm (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-239-generic (Ubuntu package)
linux-image-4.4.0-239-lowlatency (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.4.0-1117-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
kernel-devel
python3-perf-debuginfo
kernel-tools-devel
kernel-tools-debuginfo
kernel-source
perf
bpftool-debuginfo
python3-perf
perf-debuginfo
kernel-debugsource
python2-perf-debuginfo
kernel-tools
kernel-debuginfo
bpftool
python2-perf
kernel
kernel-debug-modules
kernel-tools-libs-devel
kernel-tools-libs
kernel-modules-extra
kernel-modules
kernel-headers
kernel-debug-modules-extra
python-perf
kernel-debug
kernel-debug-devel
kernel-debug-core
kernel-core
Pixel

Install updates from vendor's website.

linux-image-4.4.0-1155-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1118-kvm (Ubuntu package) - update to Ubuntu Pro
linux-image-generic-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-239-generic (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-239-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1117-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-aws (Ubuntu package) - update to Ubuntu Pro (Infra-only)
kernel-devel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python3-perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-tools-devel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-tools-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-source - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
bpftool-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python3-perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-debugsource - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python2-perf-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183
kernel-tools - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
kernel-debuginfo - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
bpftool - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
python2-perf - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183
kernel - addressed in versions 4.19.90-2212.3.0.0182, 4.19.90-2212.4.0.0183, 5.10.0-60.74.0.98
perf - update to 4.19.91-27
kernel-debug-modules - update to 4.19.91-27
kernel-tools-libs-devel - update to 4.19.91-27
kernel-tools-libs - update to 4.19.91-27
kernel-tools - update to 4.19.91-27
kernel-modules-extra - update to 4.19.91-27
kernel-modules - update to 4.19.91-27
kernel-headers - update to 4.19.91-27
kernel-devel - update to 4.19.91-27
kernel-debug-modules-extra - update to 4.19.91-27
python-perf - update to 4.19.91-27
python3-perf - update to 4.19.91-27
bpftool - update to 4.19.91-27
kernel - update to 4.19.91-27
kernel-debug - update to 4.19.91-27
kernel-debug-devel - update to 4.19.91-27
kernel-debug-core - update to 4.19.91-27
kernel-core - update to 4.19.91-27
kernel-headers - update to 5.10.0-60.74.0.98
Pixel - update to 2022-12-05

• https://source.android.com/security/bulletin/pixel/2022-12-01

• Privilege escalation in Linux kernel dm-verity
• Ubuntu update for linux-aws
• Multiple vulnerabilities in Google Pixel (December 2022)
• Ubuntu update for linux-aws
• Ubuntu update for linux
• openEuler 20.03 LTS SP1 update for kernel
• openEuler 20.03 LTS SP3 update for kernel
• openEuler 22.03 LTS update for kernel
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel(ANCK)4.19