CVE-2026-74283

Отчет

TIPCv2 generic netlink mutating operations were registered without the administrative permission flags required to enforce the expected CAP_NET_ADMIN authorization check. As a result, a local unprivileged process with no effective capabilities can invoke administrative TIPC operations that should only be available to a network administrator. Confirmed affected operations include modification of the TIPC network and node configuration, bearer enable/disable and configuration, link and monitor settings, peer removal, and setting or flushing TIPC key material. The vulnerable entry point is the local generic netlink control interface and is therefore not directly reachable through network traffic. For CVSS, AV:L and PR:L reflect that an attacker requires local code execution or an equivalent unprivileged local process context, but does not require root privileges or CAP_NET_ADMIN. Practical impact also depends on TIPC being available and having a relevant configuration on the affected system. This represents a TIPC-specific privilege-boundary bypass rather than a general kernel privilege escalation. Successful exploitation does not grant the attacker root access or arbitrary CAP_NET_ADMIN functionality; instead, it exposes a defined set of TIPC administrative mutators without their intended authorization checks. Nevertheless, these operations can significantly alter TIPC state, including network identity, bearer and link configuration, peer state, monitoring configuration, and cryptographic key material. The direct impact is primarily to integrity and availability. An attacker can make unauthorized changes to TIPC configuration, disable or enable bearers, remove peers, flush or replace key material, and otherwise disrupt TIPC or cluster communication. High integrity and availability impact are therefore defensible where TIPC is actively used. Confidentiality impact is less direct because the vulnerability does not itself disclose existing keys, kernel memory, or protected data. Any confidentiality impact would depend on additional consequences of manipulating the TIPC configuration and is more appropriately considered in a paranoid assessment.

Меры по смягчению последствий

Prevent the TIPC kernel module from loading if Transparent Inter-Process Communication is not explicitly required:

1. Create a configuration file to disable the module:

echo "install tipc /bin/true" > /etc/modprobe.d/disable-tipc.conf

echo "blacklist tipc" >> /etc/modprobe.d/disable-tipc.conf

2. Unload the module if it is currently loaded:

modprobe -r tipc

Caveats: Disabling the tipc module will break applications and services that rely on TIPC for clustering or inter-process communication. Warning: If the tipc module is actively in use, running modprobe -r will fail and a system reboot is required for the configuration changes to take full effect.