CVE-2024-42318: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42318 is a security vulnerability discovered in the Linux kernel's Landlock security module on July 24, 2024. The issue stems from a missing LSM hook implementation for the special case of keyctl(2)'s KEYCTL_SESSION_TO_PARENT. When a process' cred struct is replaced, it typically invokes the cred_prepare LSM hook, but in the case of KEYCTL_SESSION_TO_PARENT updating the parent's credentials, the cred_transfer LSM hook is used instead. Since Landlock only implemented the cred_prepare hook and not cred_transfer, this caused all information on Landlock restrictions to be lost (OSS Security).

The vulnerability exists in the credential handling mechanism of the Landlock security module. The issue occurs because Landlock only implements the cred_prepare hook but not the cred_transfer hook, which is used in the special case of KEYCTL_SESSION_TO_PARENT operations. This oversight allows processes to bypass Landlock restrictions through a combination of fork() and keyctl() syscalls. The fix involved adding a cred_transfer hook that performs the same operations as the existing cred_prepare hook, implemented by having hook_cred_prepare() call hook_cred_transfer() to prevent future divergence between the two functions (Kernel Commit).

The vulnerability only impacts sandboxing mechanisms implemented through Landlock, while the kernel itself and system services remain unaffected. The impact is limited due to the stackable LSM infrastructure. To exploit this vulnerability, an attacker needs to have full code execution capabilities including the ability to perform arbitrary syscalls, particularly keyctl(2). The vulnerability allows a process to escape its sandbox and bypass any Landlock restrictions (OSS Security).

To exploit this vulnerability, an attacker must have the ability to execute arbitrary code and perform specific syscalls, particularly fork() and keyctl(). The vulnerability has been demonstrated with a proof of concept by the original discoverer, Jann Horn. However, complementary security mechanisms can be implemented to prevent arbitrary code execution or syscalls, such as using seccomp filters (OSS Security).

The vulnerability was fixed within hours of discovery and included in Linux 6.11-rc1, released on July 28, 2024. The fix has been backported to multiple Linux kernel versions: Linux 6.10.3, 6.6.44, 6.1.103 (all released on August 3), and Linux 5.15.165. To address this vulnerability, only the kernel needs to be updated; sandboxed programs will automatically be properly sandboxed with an up-to-date kernel. Users can verify the fix by running the provided test suite on an up-to-date kernel source tree (OSS Security).

The discovery led to broader discussions about improving or removing the KEYCTL_SESSION_TO_PARENT special case in the Linux kernel. The Linux kernel community acknowledged the need for more security experts to proactively identify similar issues, with reward programs being suggested as one way to encourage such efforts (OSS Security).