In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: route MIGRATE notifications to caller’s netns<\/p>\n
xfrm_send_migrate() in net\/xfrm\/xfrm_user.c and pfkey_send_migrate()
\nin net\/key\/af_key.c both hardcode &init_net for the multicast that
\nannounces a successful XFRM_MSG_MIGRATE \/ SADB_X_MIGRATE.<\/p>\n
XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the
\nrest of the xfrm\/af_key netlink path was made netns-aware in 2008.
\nThe other 14 multicast paths in xfrm_user.c route their event using
\nxs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path
\nwas missed.<\/p>\n
Two consequences of the init_net hardcoding:<\/p>\n
1. The notification (selector, old\/new endpoint addresses, and the
\n km_address) is delivered to listeners on init_net’s
\n XFRMNLGRP_MIGRATE \/ pfkey BROADCAST_ALL groups rather than on
\n the issuing netns. An IKE daemon running in init_net therefore
\n receives migration notifications originating from any other
\n netns on the host.<\/p>\n
2. An IKE daemon running inside a non-init netns and subscribed
\n to its own XFRMNLGRP_MIGRATE \/ pfkey groups never receives the
\n notification of its own migration. IKEv2 MOBIKE \/ address-update
\n handling inside a netns is silently broken.<\/p>\n
Thread struct net through km_migrate() and the xfrm_mgr.migrate
\nfunction pointer, drop the &init_net override in xfrm_send_migrate()
\nand pfkey_send_migrate(), and pass the caller’s net (already in
\nscope in xfrm_migrate() via sock_net(skb->sk)) all the way down.
\nstruct xfrm_mgr is in-tree only and not exported as a stable API,
\nso the function-pointer signature change is internal.<\/p>\n
pfkey_broadcast() is already netns-aware via net_generic(net,
\npfkey_net_id) since the pernet conversion. The five other
\npfkey_broadcast() callers in af_key.c already pass xs_net(x),
\nsock_net(sk) or a per-netns net, so this only removes the
\n&init_net outlier.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: route MIGRATE notifications to caller’s netns<\/p>\n
xfrm_send_migrate() in net\/xfrm\/xfrm_user.c and pfkey_send_migrate()
\nin net\/ke<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14952","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}