Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-vv6c-69r6-chg9

Published Oct 14, 2024·Last modified Oct 15, 2024
Affected Components(0)

No affected components available

Description

Impact

When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply:

  • They use Landlock rulesets that are supposed to restrict networking (through landlock.V4, landlock.V5, or self-configured).
  • These Landlock rulesets are used in best-effort mode.

Typically, affected code uses the Go-Landlock API like this (the crucial part being the combination of V4/V5 and .BestEffort()):

err := landlock.V5.BestEffort().Restrict(...)
  • This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.
  • The bug only affects networking restrictions. File system restrictions continue to work as expected.

Patches

Patched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b Users should upgrade to: v0.0.0-20241013234402-fb3ad845df46

Go package dependencies can be updated using go get -u from the project directory.

Projects on Github might get notified by Dependabot, once this advisory is public.

Workarounds

None.

References

Currently none.

The existing users of Go-Landlock on Github have the following bugs filed:

  • https://github.com/Foxboron/ssh-the-planet/issues/1
  • https://github.com/ngergs/websrv/issues/15
  • https://github.com/pufferffish/wireproxy/issues/142
Risk Scores
Base Score
0.0

Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.

Threat Intelligence
0.0

No exploitation activity has been observed at this time. Continue routine monitoring.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard