CVE-2024-42318 landlock: Don't lose track of restrictions on cred_transfer
A flaw in the Linux kernel allows processes to bypass Landlock security restrictions via keyctl, potentially escaping sandboxed environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42318?
CVE-2024-42318 is a high-severity vulnerability in Linux kernel, published on 17 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
landlock: Don't lose track of restrictions on cred_transfer
When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost.
This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself.
Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.)
Which versions are affected by CVE-2024-42318?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-42318?
Apply the vendor's patch.
Is CVE-2024-42318 being exploited?
There is no known exploitation of CVE-2024-42318 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-42318, DEBIAN-CVE-2024-42318, GHSA-g9x3-hhpq-jcqm, UBUNTU-CVE-2024-42318.