Описание
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
A flaw was found in the Linux kernel. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag, possibly disabling seccomp.
Меры по смягчению последствий
If ptrace is not required, ptrace can be disabled in multiple ways.
- SELinux policy.
setsebool -P deny_ptrace on
- Kernel sysctl.
sysctl -w kernel.yama.ptrace_scope=3
Or to make persistent , create /etc/sysctl.d/99-yama-ptrace_scope.conf kernel.yama.ptrace_scope=3 If you need further assistance, see the KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 7 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2023:2736 | 16.05.2023 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2023:2951 | 16.05.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | kernel | Fixed | RHSA-2024:0412 | 25.01.2024 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2022:7318 | 02.11.2022 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2023:0334 | 23.01.2023 |
| Red Hat Enterprise Linux 9 | kernel-rt | Fixed | RHSA-2022:7319 | 02.11.2022 |
| Red Hat Enterprise Linux 9 | kernel-rt | Fixed | RHSA-2023:0300 | 23.01.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTR ...
Security update for the Linux Kernel (Live Patch 44 for SLE 12 SP3)
EPSS
5.5 Medium
CVSS3