Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: undo netns switch if renaming the wiphy fails
Once all the interfaces have been moved, cfg80211_switch_netns()
moves the wiphy itself by setting its network namespace and then
renaming it, which makes sysfs move it. The rename can fail (but
only on allocation failures), leaving things mixed up and hitting
the warning there.
Ignoring it isn't great, undo the move and let the change fail
in this case. If undo fails then WARN, then things would again
be stuck in two different network namespaces.
A flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem. This flaw allows a local user to cause a Denial of Service (DoS) when switching a wireless device between network namespaces (isolated virtual network environments). If the device rename operation fails due to memory allocation errors, the kernel does not properly undo the migration, leaving interfaces stranded across different namespaces and triggering kernel warnings that destabilize network operations.
Отчет
A flaw of low impact was found in the cfg80211 wireless configuration subsystem of the Linux kernel. When a local user holding the CAP_NET_ADMIN privilege moves a wireless device (wiphy) between network namespaces via nl80211 operations, cfg80211_switch_netns() first moves all interfaces and then renames the wiphy so that sysfs relocates it. If that rename fails due to a memory allocation failure, the migration was not undone, leaving the wireless interfaces and the wiphy stranded across two different network namespaces in an inconsistent state, triggering a kernel warning and disrupting the management and operation of the affected wireless device; confidentiality and integrity are not impacted. Red Hat rates this flaw Low impact rather than the Moderate severity implied by the CVSS:3.1 availability-only score of 5.5, because triggering it requires an already-privileged local actor to encounter a memory allocation failure during the rename, a condition that is difficult to control in practice. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the kernel packages in Red Hat In-Vehicle OS, and the RHEL CoreOS 8 and 9 layers of OpenShift Container Platform are affected; on these streams the fix is deferred to a future planned update given the low severity and limited exploitability of the issue, and the residual risk is a local, privilege- and memory-pressure-dependent denial of service restricted to wireless devices whose network namespace switch fails. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this flaw.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211_switch_netns() moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. The rename can fail (but only on allocation failures), leaving things mixed up and hitting the warning there. Ignoring it isn't great, undo the move and let the change fail in this case. If undo fails then WARN, then things would again be stuck in two different network namespaces.
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211_switch_netns() moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. The rename can fail (but only on allocation failures), leaving things mixed up and hitting the warning there. Ignoring it isn't great, undo the move and let the change fail in this case. If undo fails then WARN, then things would again be stuck in two different network namespaces.
wifi: cfg80211: undo netns switch if renaming the wiphy fails
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211_switch_netns() moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. The rename can fail (but only on allocation failures), leaving things mixed up and hitting the warning there. Ignoring it isn't great, undo the move and let the change fail in this case. If undo fails then WARN, then things would again be stuck in two different network namespaces.
5.5 Medium
CVSS3