security/wiki
8
0
Fork 1
generated from sig_core/wiki-template
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: security:7718c9d5314e8d06bc3a468171e6b916d5113d0d
Branches Tags
security:main
security:gh-pages
security:update/cve-2024-6387
..
compare: security:ce94068981e82925bb47b216e92bde751d98c49f
Branches Tags
security:gh-pages
security:main
security:update/cve-2024-6387

No commits in common. "7718c9d5314e8d06bc3a468171e6b916d5113d0d" and "ce94068981e82925bb47b216e92bde751d98c49f" have entirely different histories.
7718c9d531 ... ce94068981

1 changed files with 3 additions and 12 deletions
Show Stats Expand all files Collapse all files

15
docs/issues/CVE-2024-1086.md
View File

@ -14,14 +14,9 @@ Exploitation of the flaw is [described in great detail in a blog post by Notselw
Public disclosure date: March 26, 2024 for the above blog post, which made the issue widely known Public disclosure date: March 26, 2024 for the above blog post, which made the issue widely known
## EL9 ## Status
Affected. We will of course rebuild upstream's fix as soon as it arrives. Meanwhile, please refer to the mitigations below. Both EL9 and EL8 are affected. We will of course rebuild upstream's fix as soon as it arrives.
## EL8
- Fixed in version: `kernel-4.18.0-513.24.1.el8_9` available April 5, 2024
- Errata: [RLSA-2024:1607](https://errata.rockylinux.org/RLSA-2024:1607) issued April 5, 2024
## Mitigation ## Mitigation
@ -35,9 +30,7 @@ sysctl -p /etc/sysctl.d/userns.conf
``` ```
This is a mitigation also suggested by Red Hat. This is a mitigation also suggested by Red Hat.
It is sufficient to fully mitigate this and other/future related vulnerabilities. It is expected to fully mitigate this and other/future related vulnerabilities.
- If you cannot disable user namespaces, you may nevertheless be able to [disable network namespaces](https://www.openwall.com/lists/oss-security/2024/04/14/1), which is also sufficient to fully mitigate this and some other/future related vulnerabilities.
- Install our [package of LKRG](../packages/lkrg.md), start and enable the service. - Install our [package of LKRG](../packages/lkrg.md), start and enable the service.
@ -45,5 +38,3 @@ This does not fully mitigate the vulnerability,
but it reliably prevents the specific exploit referenced above from working and produces LKRG alerts when the exploit is run. but it reliably prevents the specific exploit referenced above from working and produces LKRG alerts when the exploit is run.
LKRG's feature that does so is its allow list for the kernel's usermodehelper. LKRG's feature that does so is its allow list for the kernel's usermodehelper.
This will similarly prevent other/future exploits that abuse usermodehelper. This will similarly prevent other/future exploits that abuse usermodehelper.
The remaining risks are Denial of Service (DoS) as even interrupted exploits may leave the system in an unstable state,
and a different exploit of the same vulnerability bypassing LKRG.