Описание
In the Linux kernel, the following vulnerability has been resolved:
sctp: close UDP tunnel sockets during netns teardown
proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when
net.sctp.udp_port is set, and stops/restarts them when the sysctl value
changes. The netns exit path does not stop these sockets, so a namespace
can be torn down while its SCTP UDP tunnel sockets are still installed.
Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering
the per-net sysctl table. This prevents new sysctl writes from racing in
while the sockets are being released, and closes the sockets before the
control socket is destroyed.
A flaw was found in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. When a network namespace (netns) is torn down, the associated SCTP UDP (User Datagram Protocol) tunnel sockets are not properly closed. This oversight can lead to a resource leak, potentially resulting in a denial of service (DoS) condition due to resource exhaustion or unexpected behavior during subsequent system calls.
Отчет
A MODERATE impact flaw was found in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. When a network namespace that has SCTP UDP tunneling enabled (through the net.sctp.udp_port sysctl) is torn down, the per-namespace SCTP UDP tunnel sockets are not closed, leaking kernel resources. A local user with the privileges required to configure the sysctl and to create and destroy network namespaces could repeatedly do so to exhaust resources, resulting in a denial of service. Fixes are being pursued by the delegated engineering teams for the affected RHEL kernel and kernel-rt update streams and the Red Hat In-Vehicle OS streams. Red Hat Enterprise Linux 6 and 7 ELS kernels and the RHEL 8.4 kernel and kernel-rt streams are not affected because the vulnerable code is not present in those builds; certain older delegated kernel-rt update streams have been marked won't fix. The CVE.org record scores this flaw 9.8 CRITICAL assuming a network-based, unauthenticated attack vector; Red Hat's CVSS 3.1 score of 7.0 reflects that exploitation requires local access with privileges to configure SCTP UDP tunneling and manage network namespaces.
Меры по смягчению последствий
SCTP UDP tunneling can be disabled by leaving the net.sctp.udp_port sysctl unset or setting it to 0. Per-network-namespace SCTP UDP tunnel sockets are only created when net.sctp.udp_port is configured to a non-zero port, and changing the sysctl value stops the existing tunnel sockets, so namespaces torn down afterwards no longer leak them. This workaround disables SCTP-over-UDP encapsulation and is not suitable for environments that require it; such environments have no workaround other than upgrading to a fixed kernel.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Will not fix | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux for NVIDIA 26 | kernel | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed.
In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed.
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown proc_sctp_do_udp_port() starts per-net SCTP UDP tunneling sockets when net.sctp.udp_port is set, and stops/restarts them when the sysctl value changes. The netns exit path does not stop these sockets, so a namespace can be torn down while its SCTP UDP tunnel sockets are still installed. Close the UDP tunnel sockets from sctp_ctrlsock_exit() after unregistering the per-net sysctl table. This prevents new sysctl writes from racing in while the sockets are being released, and closes the sockets before the control socket is destroyed.
EPSS
7 High
CVSS3