CVE-2021-46912

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: Make tcp_allowed_congestion_control readonly in non-init netns

Currently, tcp_allowed_congestion_control is global and writable;

writing to it in any net namespace will leak into all other net

namespaces.

tcp_available_congestion_control and tcp_allowed_congestion_control are

the only sysctls in ipv4_net_table (the per-netns sysctl table) with a

NULL data pointer; their handlers (proc_tcp_available_congestion_control

and proc_allowed_congestion_control) have no other way of referencing a

struct net. Thus, they operate globally.

Because ipv4_net_table does not use designated initializers, there is no

easy way to fix up this one "bad" table entry. However, the data pointer

updating logic shouldn't be applied to NULL pointers anyway, so we

instead force these entries to be read-only.

These sysctls used to exist in ipv4_table (init-net only), but they were

moved to the per-net ipv4_net_table, presumably without r

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References