CVE-2024-42318

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42318
In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost. This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself. Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugs.chromium.org/p/project-zero/issues/detail?id=2566 Issue Tracking Third Party Advisory
https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c Patch
https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49 Patch
https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1 Patch
https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117 Patch
https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff Patch
https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/ Mailing List
https://www.openwall.com/lists/oss-security/2024/08/17/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/08/17/2 Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Oct 2025, 20:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://bugs.chromium.org/p/project-zero/issues/detail?id=2566 - () https://bugs.chromium.org/p/project-zero/issues/detail?id=2566 - Issue Tracking, Third Party Advisory
References () https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c - () https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c - Patch
References () https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49 - () https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49 - Patch
References () https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1 - () https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1 - Patch
References () https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117 - () https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117 - Patch
References () https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff - () https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff - Patch
References () https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/ - () https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/ - Mailing List
References () https://www.openwall.com/lists/oss-security/2024/08/17/2 - () https://www.openwall.com/lists/oss-security/2024/08/17/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2024/08/17/2 - () http://www.openwall.com/lists/oss-security/2024/08/17/2 - Mailing List
CWE NVD-CWE-noinfo

21 Nov 2024, 09:33

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/08/17/2 -

19 Aug 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: landlock: no pierda de vista las restricciones en cred_transfer Cuando se reemplaza la estructura cred de un proceso, esto _almost_ always invoca el gancho LSM cred_prepare; pero en un caso especial (cuando KEYCTL_SESSION_TO_PARENT actualiza las credenciales de los padres), se utiliza el gancho LSM cred_transfer. Landlock solo implementa el gancho cred_prepare, no cred_transfer, por lo que KEYCTL_SESSION_TO_PARENT hace que se pierda toda la información sobre las restricciones de Landlock. Básicamente, esto significa que un proceso con la capacidad de utilizar las llamadas al sistema fork() y keyctl() puede deshacerse de todas las restricciones de Landlock sobre sí mismo. Solucionelo agregando un gancho cred_transfer que haga lo mismo que el gancho cred_prepare existente. (Se implementa haciendo que hook_cred_prepare() llame a hook_cred_transfer() para que sea menos probable que las dos funciones diverjan accidentalmente en el futuro).

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117 -

18 Aug 2024, 09:15

Type Values Removed Values Added
References
  • () https://bugs.chromium.org/p/project-zero/issues/detail?id=2566 -
  • () https://www.openwall.com/lists/oss-security/2024/08/17/2 -

17 Aug 2024, 17:15

Type Values Removed Values Added
References
  • () https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/ -

17 Aug 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-17 09:15

Updated : 2025-10-07 20:24

NVD link : CVE-2024-42318

Mitre link : CVE-2024-42318

CVE.ORG link : CVE-2024-42318

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo