Описание
In the Linux kernel, the following vulnerability has been resolved:
ima: Instantiate file_truncate and path_truncate hooks
Instantiate the file_truncate and path_truncate LSM hooks to reset the
action cache flags (IMA_DONE_MASK) as soon as truncation is requested,
so the file, based on policy, is re-collected, re-measured, re-audited,
and re-appraised on next access.
A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). When a file is truncated, the system's integrity policy hooks are not properly instantiated, preventing the action cache flags from being reset. This oversight means that after truncation, the file is not re-collected, re-measured, re-audited, and re-appraised on subsequent access, potentially allowing an attacker to bypass integrity checks.
Отчет
A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). The file_truncate and path_truncate LSM hooks were not instantiated in IMA, so when a file is truncated the action cache flags (IMA_DONE_MASK) are not reset. As a result, a truncated file is not re-collected, re-measured, re-audited, and re-appraised on the next access according to the IMA policy. A local attacker with the ability to truncate a file could exploit this to bypass IMA integrity checks, causing stale measurement, audit, or appraisal state to be trusted even though the file contents have changed. Red Hat rates this flaw as moderate severity (CVSS 5.5, local attack vector) because exploitation requires local access and write permission to a file, and the impact is limited to the integrity of IMA-enforced files rather than confidentiality or availability; this differs from the upstream CVEORG rating of 8.1/important, which assumes a network attack vector and high confidentiality and integrity impact. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10 and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. For the affected products, the fix is currently deferred, and systems that rely on IMA measurement or appraisal policies remain exposed to this integrity-policy bypass until a fix is released.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access.
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access.
EPSS
5.5 Medium
CVSS3