| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-46912: net: Make tcp_allowed_congestion_control readonly in non-init netns |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: Make tcp_allowed_congestion_control readonly in non-init netns |
| |
| Currently, tcp_allowed_congestion_control is global and writable; |
| writing to it in any net namespace will leak into all other net |
| namespaces. |
| |
| tcp_available_congestion_control and tcp_allowed_congestion_control are |
| the only sysctls in ipv4_net_table (the per-netns sysctl table) with a |
| NULL data pointer; their handlers (proc_tcp_available_congestion_control |
| and proc_allowed_congestion_control) have no other way of referencing a |
| struct net. Thus, they operate globally. |
| |
| Because ipv4_net_table does not use designated initializers, there is no |
| easy way to fix up this one "bad" table entry. However, the data pointer |
| updating logic shouldn't be applied to NULL pointers anyway, so we |
| instead force these entries to be read-only. |
| |
| These sysctls used to exist in ipv4_table (init-net only), but they were |
| moved to the per-net ipv4_net_table, presumably without realizing that |
| tcp_allowed_congestion_control was writable and thus introduced a leak. |
| |
| Because the intent of that commit was only to know (i.e. read) "which |
| congestion algorithms are available or allowed", this read-only solution |
| should be sufficient. |
| |
| The logic added in recent commit |
| 31c4d2f160eb: ("net: Ensure net namespace isolation of sysctls") |
| does not and cannot check for NULL data pointers, because |
| other table entries (e.g. /proc/sys/net/netfilter/nf_log/) have |
| .data=NULL but use other methods (.extra2) to access the struct net. |
| |
| The Linux kernel CVE team has assigned CVE-2021-46912 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.7 with commit 9cb8e048e5d93825ec5e8dfb5b8df4987ea25745 and fixed in 5.10.32 with commit 35d7491e2f77ce480097cabcaf93ed409e916e12 |
| Issue introduced in 5.7 with commit 9cb8e048e5d93825ec5e8dfb5b8df4987ea25745 and fixed in 5.11.16 with commit 1ccdf1bed140820240e383ba0accc474ffc7f006 |
| Issue introduced in 5.7 with commit 9cb8e048e5d93825ec5e8dfb5b8df4987ea25745 and fixed in 5.12 with commit 97684f0970f6e112926de631fdd98d9693c7e5c1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-46912 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/ipv4/sysctl_net_ipv4.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/35d7491e2f77ce480097cabcaf93ed409e916e12 |
| https://git.kernel.org/stable/c/1ccdf1bed140820240e383ba0accc474ffc7f006 |
| https://git.kernel.org/stable/c/97684f0970f6e112926de631fdd98d9693c7e5c1 |
