CVE-2024-42318: landlock: Don't lose track of restrictions on cred_transfer
In the Linux kernel, the following vulnerability has been resolved:
landlock: Don't lose track of restrictions on credtransfer
When a process' cred struct is replaced, this almost always invokes the credprepare LSM hook; but in one special case (when KEYCTLSESSIONTOPARENT updates the parent's credentials), the credtransfer LSM hook is used instead. Landlock only implements the credprepare hook, not credtransfer, so KEYCTLSESSIONTOPARENT causes all information on Landlock restrictions to be lost.
This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself.
Fix it by adding a credtransfer hook that does the same thing as the existing credprepare hook. (Implemented by having hookcredprepare() call hookcredtransfer() so that the two functions are less likely to accidentally diverge in the future.)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Update the Landlock implementation to include a cred_transfer LSM hook that does the same thing as the existing cred_prepare hook, so that KEYCTL_SESSION_TO_PARENT credential updates do not lose Landlock restrictions (Landlock Houdini fix: CVE-2024-42318).
Linux kernel Landlock LSM LSM hooks for credential replacement = Add/implement cred_transfer hook to perform the same restriction-tracking logic as the existing cred_prepare hook
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42318?
CVE-2024-42318 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-42318?
To fix CVE-2024-42318, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-42318?
CVE-2024-42318 affects multiple Linux kernel versions prior to the patched releases listed in the fix.
Is CVE-2024-42318 a DoS vulnerability?
CVE-2024-42318 does not directly result in a denial of service, but it can lead to privilege escalation under specific conditions.
What systems are at risk from CVE-2024-42318?
Systems running vulnerable versions of the Linux kernel are at risk from CVE-2024-42318 and should be promptly updated.