Към съдържанието
Търсене

CVE-2026-97476: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: rds: filter RDS_INFO_* getsockopt by caller's netns The RDS_INFO_* family of getsockopt(2) options reads several file-scope global lists that are not per-netns: rds_sock_info / rds6_sock_info, rds_sock_inc_info / rds6_sock_inc_info -> rds_sock_list rds_tcp_tc_info / rds6_tcp_tc_info -> rds_tcp_tc_list rds_conn_info / rds6_conn_info, rds_conn_message_info_cmn (for the *_SEND_MESSAGES and *_RETRANS_MESSAGES variants), rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS) -> rds_conn_hash[] The handlers do not filter by the caller's network namespace. rds_info_getsockopt() has no netns or capable() check, and rds_create() has no capable() check, so AF_RDS is reachable from an unprivileged user namespace. As a result, an unprivileged caller in a fresh user_ns plus netns can read the bound address and sock inode of every RDS socket on the host, the peer address of incoming messages on every RDS socket on the host, the peer address and TCP sequence numbers of every rds-tcp connection on the host, and the peer address and RDS sequence numbers of every RDS connection on the host. The rds-tcp transport is reachable from a non-initial netns (see rds_set_transport()), so a one-shot init_net gate at rds_info_getsockopt() would deny legitimate per-netns visibility to rds-tcp callers. Instead, filter at each handler by comparing the netns of the caller's socket to the netns of the list entry, or to rds_conn_net(conn) for connection paths. Only copy entries whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are aggregate statistics and remain global. Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket binds 127.0.0.1:4242 in init_net as root. A child process enters a fresh user_ns plus netns and opens AF_RDS there, then calls getsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the child sees the init_n

    Засегнати продукти

    • Linux Linux: 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди 64ca5839916176c3451f61a2c7178033423c67d7; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди 8b04dda272c30d46834bb03dd2895b08c090483b; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди f05142d0eeaa6e8227511c88e10a2b8fe7a78fc4; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди 65fae4b42269dbea7e3842ae4dd0786162c6248e; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди 093f172296d32499ffac7809629b206178776eb6; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди c4081e49ebe0e3160c4b70ec7639494792dee206; 639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4 преди c96a5209dda666004b8ee1ed7f0d493d09a4f200
    • Linux Linux: 2.6.30; преди 2.6.30; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; от 7.2 нататък

    История

    • 24 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-97476: Linux | freedomonline.bg