There seems to be a new vulnerability in the kernel networking stack affecting most distros. Is this CVE as bad as it sounds? I can't see much information about it except the newly published CVE and Vercel's blog post.
Does anyone have more information about it? What is the requirements for it to be exploitable and how have you handled it in your stack/distro to protect your assets?
The bug is in skb_checksum_help(): an IPv4 packet with bad checksum metadata can corrupt the network header, according to patch author Michael S. Tsirkin. I am entirely guessing but the attack vector could be related to user namespaces. AV:L means it can’t be triggered over the network alone. The attacker needs code running on the box. PR:N means that code doesn’t need a real account. An unprivileged service user is enough. S:C means it crosses a security boundary, such as escaping a sandbox or container. So probably disabling user namespaces could be a preventative step, maybe. There should be kernel updates available to each distro as soon as the recent upstream build gets through the build/review process in each distro either way.
Look for anything using user namespaces before disabling on servers. Do not disable on workstations/laptops as many apps use user namespaces. Test on servers with an ephemeral setting before touching sysctl.conf.
r=$(readlink /proc/1/ns/user); for p in /proc/[0-9]*; do u=$(readlink $p/ns/user 2>/dev/null) || continue; [ "$u" = "$r" ] || echo "${p#/proc/} $(cat $p/comm 2>/dev/null)"; done
# in dev/qa, not on laptop.
sysctl -w user.max_user_namespaces=0
# restart all applications and test, full regression
There seems to be a new vulnerability in the kernel networking stack affecting most distros. Is this CVE as bad as it sounds? I can't see much information about it except the newly published CVE and Vercel's blog post.
Does anyone have more information about it? What is the requirements for it to be exploitable and how have you handled it in your stack/distro to protect your assets?
The bug is in skb_checksum_help(): an IPv4 packet with bad checksum metadata can corrupt the network header, according to patch author Michael S. Tsirkin. I am entirely guessing but the attack vector could be related to user namespaces. AV:L means it can’t be triggered over the network alone. The attacker needs code running on the box. PR:N means that code doesn’t need a real account. An unprivileged service user is enough. S:C means it crosses a security boundary, such as escaping a sandbox or container. So probably disabling user namespaces could be a preventative step, maybe. There should be kernel updates available to each distro as soon as the recent upstream build gets through the build/review process in each distro either way.
Look for anything using user namespaces before disabling on servers. Do not disable on workstations/laptops as many apps use user namespaces. Test on servers with an ephemeral setting before touching sysctl.conf.