{"id":118544,"date":"2024-07-29T09:43:08","date_gmt":"2024-07-29T07:43:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii"},"modified":"2024-07-29T09:43:08","modified_gmt":"2024-07-29T07:43:08","slug":"oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/oshibka-v-lsm-module-landlock-pozvolyala-zanovo-poluchit-sbroshennye-privilegii","title":{"rendered":"A flaw in the Landlock LSM module allowed revoked privileges to be regained.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jann Horn from the Google Project Zero team, who previously identified the Spectre and Meltdown vulnerabilities, discovered a logic error in the implementation of the Linux Security Module (LSM) Landlock, which allows a program to regain already revoked privileges if it has access to the fork() and keyctl() system calls. <\/p>\n
The Landlock mechanism enables unprivileged programs to drop unnecessary privileges, voluntarily limiting their further access to the system for increased security, for instance, to protect against exploitation attempts of vulnerabilities in the program. For example, a program can prohibit itself from accessing files outside its working directory. <\/p>\n
As discovered by a Google engineer, there were some scenarios not anticipated by the module\u2019s developers, allowing a program to regain revoked privileges under certain conditions. The flaw exists in all kernel versions with the Landlock LSM module, as it is present in the initial implementation of this module. A fix that addresses the identified issue has been included in today\u2019s test release of kernel 6.11-rc1 but has not yet been merged into stable branches. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"