cve-2024-47659
Vulnerability from cvelistv5
Published
2024-10-09 14:02
Modified
2024-11-05 09:48
Severity ?
EPSS score ?
Summary
smack: tcp: ipv4, fix incorrect labeling
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T13:23:30.727932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T13:23:46.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/smack/smack_lsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3f56c653c65",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "5b4b304f196c",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "a948ec993541",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "0aea09e82eaf",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "0776bcf9cb6d",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "4be9fd15c3c8",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "d3703fa94116",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
},
{
"lessThan": "2fe209d0ad2e",
"status": "affected",
"version": "1da177e4c3f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/smack/smack_lsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.322",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.284",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.226",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label \u0027foo\u0027 connects to a label \u0027bar\u0027 with tcp/ipv4,\n\u0027foo\u0027 always gets \u0027foo\u0027 in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled (\u0027foo\u0027 instead of \u0027bar\u0027)\n2) \u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let\u0027s call them C and S,\n with active Smack in the default state\n (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule \u0027foo bar w\u0027\n (labels \u0027foo\u0027 and \u0027bar\u0027 are instantiated at S at this moment)\n\n* At S, at label \u0027bar\u0027, launch a program\n that listens for incoming tcp/ipv4 connections\n\n* From C, at label \u0027foo\u0027, connect to the listener at S.\n (label \u0027foo\u0027 is instantiated at C at this moment)\n Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label \u0027foo\u0027. Hence, label \u0027bar\u0027 writes to \u0027foo\u0027 without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the \u0027bar\u0027,\nto bring it into line with the Smack documentation claims."
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T09:48:15.491Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8"
},
{
"url": "https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671"
},
{
"url": "https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670"
},
{
"url": "https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c"
},
{
"url": "https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9"
},
{
"url": "https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff"
},
{
"url": "https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f"
},
{
"url": "https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550"
}
],
"title": "smack: tcp: ipv4, fix incorrect labeling",
"x_generator": {
"engine": "bippy-9e1c9544281a"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-47659",
"datePublished": "2024-10-09T14:02:54.070Z",
"dateReserved": "2024-09-30T16:00:12.935Z",
"dateUpdated": "2024-11-05T09:48:15.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-47659\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-09T14:15:07.660\",\"lastModified\":\"2024-10-23T16:29:14.800\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmack: tcp: ipv4, fix incorrect labeling\\n\\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\\nwhen a label \u0027foo\u0027 connects to a label \u0027bar\u0027 with tcp/ipv4,\\n\u0027foo\u0027 always gets \u0027foo\u0027 in returned ipv4 packets. So,\\n1) returned packets are incorrectly labeled (\u0027foo\u0027 instead of \u0027bar\u0027)\\n2) \u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\\n\\nHere is a scenario how to see this:\\n\\n* Take two machines, let\u0027s call them C and S,\\n with active Smack in the default state\\n (no settings, no rules, no labeled hosts, only builtin labels)\\n\\n* At S, add Smack rule \u0027foo bar w\u0027\\n (labels \u0027foo\u0027 and \u0027bar\u0027 are instantiated at S at this moment)\\n\\n* At S, at label \u0027bar\u0027, launch a program\\n that listens for incoming tcp/ipv4 connections\\n\\n* From C, at label \u0027foo\u0027, connect to the listener at S.\\n (label \u0027foo\u0027 is instantiated at C at this moment)\\n Connection succeedes and works.\\n\\n* Send some data in both directions.\\n* Collect network traffic of this connection.\\n\\nAll packets in both directions are labeled with the CIPSO\\nof the label \u0027foo\u0027. Hence, label \u0027bar\u0027 writes to \u0027foo\u0027 without\\nbeing authorized, and even without ever being known at C.\\n\\nIf anybody cares: exactly the same happens with DCCP.\\n\\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\\nand it looks unintentional. At least, no explanation was provided.\\n\\nI changed returned packes label into the \u0027bar\u0027,\\nto bring it into line with the Smack documentation claims.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smack: tcp: ipv4, corregir etiquetado incorrecto Actualmente, Smack refleja la etiqueta de las conexiones entrantes tcp/ipv4: cuando una etiqueta \u0027foo\u0027 se conecta a una etiqueta \u0027bar\u0027 con tcp/ipv4, \u0027foo\u0027 siempre obtiene \u0027foo\u0027 en los paquetes ipv4 devueltos. Por lo tanto, 1) los paquetes devueltos est\u00e1n etiquetados incorrectamente (\u0027foo\u0027 en lugar de \u0027bar\u0027) 2) \u0027bar\u0027 puede escribir en \u0027foo\u0027 sin estar autorizado para escribir. Aqu\u00ed hay un escenario para ver esto: * Tome dos m\u00e1quinas, llam\u00e9moslas C y S, con Smack activo en el estado predeterminado (sin configuraciones, sin reglas, sin hosts etiquetados, solo etiquetas incorporadas) * En S, agregue la regla de Smack \u0027foo bar w\u0027 (las etiquetas \u0027foo\u0027 y \u0027bar\u0027 est\u00e1n instanciadas en S en este momento) * En S, en la etiqueta \u0027bar\u0027, inicie un programa que escuche conexiones entrantes tcp/ipv4 * Desde C, en la etiqueta \u0027foo\u0027, con\u00e9ctese al oyente en S. (la etiqueta \u0027foo\u0027 est\u00e1 instanciada en C en este momento) La conexi\u00f3n es exitosa y funciona. * Env\u00ede algunos datos en ambas direcciones. * Recolecte tr\u00e1fico de red de esta conexi\u00f3n. Todos los paquetes en ambas direcciones est\u00e1n etiquetados con el CIPSO de la etiqueta \u0027foo\u0027. Por lo tanto, la etiqueta \u0027bar\u0027 escribe en \u0027foo\u0027 sin estar autorizada, e incluso sin ser conocida en C. Si a alguien le importa: exactamente lo mismo sucede con DCCP. Este comportamiento se manifest\u00f3 por primera vez en la versi\u00f3n 2.6.29.4 (ver Correcciones a continuaci\u00f3n) y parece no ser intencional. Al menos, no se proporcion\u00f3 ninguna explicaci\u00f3n. Cambi\u00e9 la etiqueta de los paquetes devueltos por \\\"barra\\\" para que coincida con lo que afirma la documentaci\u00f3n de Smack.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.322\",\"matchCriteriaId\":\"29162FB8-5FA4-4DC4-86CE-5EB0CAEEF2F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.284\",\"matchCriteriaId\":\"6265A402-9C3C-438F-BFC5-4194B2568B85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.226\",\"matchCriteriaId\":\"864FC17C-501A-4823-A643-6F35D65D8A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.109\",\"matchCriteriaId\":\"790F505A-7933-48F1-B038-380A8BC5C153\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.50\",\"matchCriteriaId\":\"A56A0460-B122-44D6-B0E6-26CE9C891536\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.9\",\"matchCriteriaId\":\"F4469C96-A86B-4CC3-B2D5-C21B6B72641B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.