CVE-2022-34918-LPE-PoC

Looking at the exploit code [1], sadly, you don't... They're using the fact that you can become "root" in a new namespace. So you need cgroups. After that, you're free to change NFTables in that namespace. I was just playing around with this: $ unshare -r --net --user capsh --print and comparing it to $ sudo capsh --print Both give you all caps. Exploiting a parser bug in NFTables doesn't require access to the main namespace; just something to get past the initial cap checks. (IIUC.) Edit: the commands above were run on Ubuntu 21.10. [1] https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/ma...

Wow! If I understand correctly this is a local privilege escalation (the blog post doesn't mention "local" or "remote"). But it seems it could also be used to get remote code execution? I wish there was a list of distribution kernels that are vulnerable and which have already patched this. Would be valuable to add to the blog post and the GitHub repo. https://github.com/randorisec/CVE-2022-34918-LPE-PoC