net: Only allow init netns to set default tcp cong to a restricted algo in Kernel
Summary
GSD-2021-1000417: net: Only allow init netns to set default tcp cong to a restricted algo. Affects Kernel versions >= 6670e152447732ba90626f36dfc015a13fbf150e, < 9884f745108f7d25b189bbcd6754e284fb29ab68. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The vulnerability in question affects the Kernel's networking subsystem, specifically the default TCP congestion control algorithm. This algorithm regulates the rate at which data is transmitted over a network connection. The vulnerability allows unauthorized processes within the initial network namespace (netns) to set the default TCP congestion control algorithm to a restricted option, potentially leading to performance degradation, network instability, or even exploitation by malicious actors.
Vulnerability Detail
The vulnerability arises from a lack of proper access control checks in the Kernel's networking subsystem. Specifically, it allows processes within the initial network namespace (netns) to set the default TCP congestion control algorithm to any available option, including restricted algorithms. This can be exploited by unauthorized processes to select an algorithm that may not be suitable for the system's network environment, leading to suboptimal performance, network congestion, or even denial-of-service conditions. The impact and attack plausibility of this vulnerability have not been proven yet, but it poses a potential risk to the stability and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the initial network namespace (netns) to prevent unauthorized processes from setting the default TCP congestion control algorithm. This can be achieved by implementing appropriate access control measures, such as configuring user permissions or utilizing network namespace isolation techniques. However, applying the recommended fix by updating the Kernel is the most effective and comprehensive solution.
Conclusion
The vulnerability in the Kernel's networking subsystem allows unauthorized processes within the initial network namespace (netns) to set the default TCP congestion control algorithm to a restricted option. This can lead to suboptimal network performance, network congestion, or even denial-of-service conditions. It is crucial to update the Linux Kernel to version v5.4.119 or later to mitigate this vulnerability. Applying proper access control checks and following recommended security practices will help ensure the stability and security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows unauthorized processes within the initial network namespace (netns) to set the default TCP congestion control algorithm to a restricted option. This can result in suboptimal network performance, network congestion, or even denial-of-service conditions.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.119 or later. This update includes a commit that addresses the issue by implementing proper access control checks.
As a temporary workaround, users can restrict access to the initial network namespace (netns) to prevent unauthorized processes from setting the default TCP congestion control algorithm. However, applying the recommended fix by updating the Kernel is the most effective solution.
There is no evidence of active exploitation of this vulnerability in the wild. However, it is still important to apply the necessary updates to mitigate potential risks.
For more information about this vulnerability, including technical details and the specific commit that addresses the issue, please refer to the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
