# GHSA-vv6c-69r6-chg9: Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly

> Go-Landlock library fails to restrict TCP bind and connect operations in best-effort mode, allowing network access bypass.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Oct 2024
- **Also known as:** GO-2024-3199

## What is GHSA-vv6c-69r6-chg9?

GHSA-vv6c-69r6-chg9 is a vulnerability in github.com/landlock-lsm/go-landlock, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact
When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:

* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).
* These Landlock rulesets are used in best-effort mode.

Typically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):

```
err := landlock.V5.BestEffort().Restrict(...)
```

* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.
* The bug only affects networking restrictions. File system restrictions continue to work as expected.

### Patches
Patched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b
Users should upgrade to: v0.0.0-20241013234402-fb3ad845df46

Go package dependencies can be updated using `go get -u` from the project directory.

Projects on Github might get notified by Dependabot, once this advisory is public.

### Workarounds
None.

### References
Currently none.

[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:
* https://github.com/Foxboron/ssh-the-planet/issues/1
* https://github.com/ngergs/websrv/issues/15
* https://github.com/pufferffish/wireproxy/issues/142

## Which versions are affected by GHSA-vv6c-69r6-chg9?

3 open source packages ship an affected version, including github.com/landlock-lsm/go-landlock.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `github.com/landlock-lsm/go-landlock` | Go | All versions | 0.0.0-20241013234402-fb3ad845df46 |
| `github.com/landlock-lsm/go-landlock` | Go | From 0.0.0-20240109 | 0.0.0-20241013234402-fb3ad845df46 |
| `github.com/landlock-lsm/go-landlock` | Go | From 0.0.0-20240109 | 0.0.0-20241013234402-fb3ad845df46 |

## How do I fix GHSA-vv6c-69r6-chg9?

Upgrade github.com/landlock-lsm/go-landlock to 0.0.0-20241013234402-fb3ad845df46 or later.

## Is GHSA-vv6c-69r6-chg9 being exploited?

There is no known exploitation of GHSA-vv6c-69r6-chg9 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-vv6c-69r6-chg9 and fix it if it is affected.

What it is: GHSA-vv6c-69r6-chg9 is a vulnerability in github.com/landlock-lsm/go-landlock, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-vv6c-69r6-chg9 in the wild and no public exploit code.

Affected packages and fixed versions:
- github.com/landlock-lsm/go-landlock (Go): affected all versions; fixed in 0.0.0-20241013234402-fb3ad845df46
- github.com/landlock-lsm/go-landlock (Go): affected from 0.0.0-20240109; fixed in 0.0.0-20241013234402-fb3ad845df46
- github.com/landlock-lsm/go-landlock (Go): affected from 0.0.0-20240109; fixed in 0.0.0-20241013234402-fb3ad845df46

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/ (Markdown: https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-vv6c-69r6-chg9

---
From sbomify Insights: https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/
Summaries are generated and may contain mistakes; the official description above is the record.