PT-2024-29866 · Linux+5 · Linux Kernel+5
Jann Horn
·
Published
2024-08-17
·
Updated
2025-02-04
·
CVE-2024-42318
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
The issue arises when a process' cred struct is replaced, typically invoking the cred prepare LSM hook, but in a special case where KEYCTL SESSION TO PARENT updates the parent's credentials, the cred transfer LSM hook is used instead. Since Landlock only implements the cred prepare hook and not the cred transfer hook, this results in the loss of all Landlock restrictions on the process. A process with the ability to use the fork() and keyctl() syscalls can exploit this to bypass Landlock restrictions. The fix involves adding a cred transfer hook that functions similarly to the existing cred prepare hook, implemented by having hook cred prepare() call hook cred transfer() to prevent accidental divergence.
Recommendations
To resolve the issue, update to Linux kernel version 6.6.50 or later. As a temporary workaround, consider restricting the use of the fork() and keyctl() syscalls to minimize the risk of exploitation. Additionally, limiting access to the cred transfer hook until a patch is applied can help mitigate the issue.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu