Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3747de241a66ef2c7032d2cc2b826a47c5fa0f6a; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 82b3e7ce10c53fc12aab8904745603efc74f8c07; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ede69b8f6670600e534591664584f810d7c385f9; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c68517a3e18e20997808821c5559d0cba4d776c1; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5d39580f68e6ddeedd15e587282207489dfb3da2 |
| Linux / Linux | affected 2.6.12; unaffected 0 before 2.6.12; unaffected 6.1.176 through 6.1.*; unaffected 6.6.143 through 6.6.*; unaffected 6.12.94 through 6.12.*; unaffected 6.18.36 through 6.18.*; unaffected 7.0.13 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/3747de241a66ef2c7032d2cc2b826a47c5fa0f6a
- https://git.kernel.org/stable/c/ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba
- https://git.kernel.org/stable/c/82b3e7ce10c53fc12aab8904745603efc74f8c07
- https://git.kernel.org/stable/c/ede69b8f6670600e534591664584f810d7c385f9
- https://git.kernel.org/stable/c/c68517a3e18e20997808821c5559d0cba4d776c1
- https://git.kernel.org/stable/c/5d39580f68e6ddeedd15e587282207489dfb3da2
ADP enrichment
No English description supplied.