Bug 1992815 (CVE-2021-38209)

Summary:	CVE-2021-38209 kernel: net/netfilter/nf_conntrack_standalone.c allows observation of changes in any net namespace because these changes are leaked into all other net namespaces
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, bdettelb, bhu, blc, brdeoliv, bskeggs, chwhite, crwood, dhoward, dvlasenk, fhrbata, fpacheco, hdegoede, hkrzesin, jarod, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, steved, tomckay, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.13-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel. Observation of changes in any net namespace is possible due to these changes being leaked into all other net namespaces. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-08 02:29:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1992817, 1994243
Bug Blocks:	1992818

Description Guilherme de Almeida Suckevicz 2021-08-11 18:53:53 UTC

The network connection tracking implementation in netfilter module of the Linux kernel allows observation of changes of sysctl settingsin any net namespace as these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.

Reference and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2671fa4dc0109d3fb581bc3078fdf17b5d9080f6

Comment 1 Guilherme de Almeida Suckevicz 2021-08-11 18:54:30 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1992817]

Comment 2 Justin M. Forbes 2021-08-12 13:36:08 UTC

This was fixed for Fedora with the 5.11.19 stable kernel updates.

Comment 8 juneau 2021-08-17 12:01:02 UTC

Marking Hosted OCP and Other Services 'notaffected' per kernel analysis.