CVE-2021-47128

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks

Commit 59438b46471a ("security,lockdown,selinux: implement SELinux lockdown")

added an implementation of the locked_down LSM hook to SELinux, with the aim

to restrict which domains are allowed to perform operations that would breach

lockdown. This is indirectly also getting audit subsystem involved to report

events. The latter is problematic, as reported by Ondrej and Serhei, since it

can bring down the whole system via audit:

1) The audit events that are triggered due to calls to security_locked_down()

can OOM kill a machine, see below details [0].

2) It also seems to be causing a deadlock via avc_has_perm()/slow_avc_audit()

when trying to wake up kauditd, for example, when using trace_sched_switch()

tracepoint, see details in [1]. Triggering this was not via some hypothetical

corner case, but with existing tools like runqla

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References