In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: qrtr: restrict socket creation to the initial network namespace<\/p>\n
QRTR keeps its entire port and node state in module-global variables
\nthat are not partitioned per network namespace: qrtr_local_nid is a
\nsingle global node id (always 1) and qrtr_ports is a single global
\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that
\nglobal state with no network-namespace check, and qrtr_create() places
\nno restriction on the namespace a socket is created in.<\/p>\n
As a result an unprivileged process that creates an AF_QIPCRTR socket
\nin a separate network namespace, e.g. via
\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams –
\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER – to QRTR
\nsockets owned by another namespace, and vice versa. The receiving
\nsocket sees such a message as coming from node id 1, indistinguishable
\nfrom a legitimate local client, breaking the isolation that network
\nnamespaces are expected to provide.<\/p>\n
QRTR is a transport to global hardware endpoints (the modem and other
\nremote processors) and has no per-namespace semantics; its in-kernel
\nname service already creates its socket in init_net only. Confine the
\nsocket family to the initial network namespace, as other
\nnon-namespace-aware socket families do (see llc_ui_create() and the
\nieee802154 socket code).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: qrtr: restrict socket creation to the initial network namespace<\/p>\n
QRTR keeps its entire port and node state in module-global va<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5413","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}