In the Linux kernel, the following vulnerability has been resolved: net:
Only allow init netns to set default tcp cong to a restricted algo
tcp_set_default_congestion_control() is netns-safe in that it writes to
&net->ipv4.tcp_congestion_control, but it also sets ca->flags |=
TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended
side-effect of changing the global net.ipv4.tcp_allowed_congestion_control
sysctl, despite the fact that it is read-only: 97684f0970f6 (“net: Make
tcp_allowed_congestion_control readonly in non-init netns”) Resolve this
netns “leak” by only allowing the init netns to set the default algorithm
to one that is restricted. This restriction could be removed if
tcp_allowed_congestion_control were namespace-ified in the future. This bug
was uncovered with
https://github.com/JonathonReinhart/linux-netns-sysctl-verify
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux | < 5.4.0-77.86 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws | < 5.4.0-1051.53 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws-5.4 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | linux-aws-hwe | < 4.15.0-1109.116~16.04.1 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure | < 5.4.0-1051.53 | UNKNOWN |
ubuntu | 14.04 | noarch | linux-azure | < 4.15.0-1121.134~14.04.1 | UNKNOWN |
ubuntu | 16.04 | noarch | linux-azure | < 4.15.0-1121.134~16.04.1 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-azure-4.15 | < any | UNKNOWN |
git.kernel.org/linus/8d432592f30fcc34ef5a10aac4887b4897884493 (5.13-rc1)
git.kernel.org/stable/c/6c1ea8bee75df8fe2184a50fcd0f70bf82986f42
git.kernel.org/stable/c/8d432592f30fcc34ef5a10aac4887b4897884493
git.kernel.org/stable/c/9884f745108f7d25b189bbcd6754e284fb29ab68
git.kernel.org/stable/c/992de06308d9a9584d59b96d294ac676f924e437
git.kernel.org/stable/c/e7d7bedd507bb732e600403b7a96f9fe48d0ca31
git.kernel.org/stable/c/efe1532a6e1a8e3c343d04fff510f0ed80328f9c
launchpad.net/bugs/cve/CVE-2021-47010
nvd.nist.gov/vuln/detail/CVE-2021-47010
security-tracker.debian.org/tracker/CVE-2021-47010
www.cve.org/CVERecord?id=CVE-2021-47010