Bug 2173435 (CVE-2023-1076)

Summary:	CVE-2023-1076 kernel: tap: tap_open(): correctly initialize socket uid
Product:	[Other] Security Response	Reporter:	Alex <allarkin>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, arachman, bhu, chayang, chwhite, crwood, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, lgoncalv, lveyde, lzampier, michal.skrivanek, mperina, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, scweaver, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.1.16	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and get unauthorized access to some resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2212180, 2212181, 2212182, 2212183, 2212184
Bug Blocks:	2172923

Description Alex 2023-02-26 17:20:14 UTC

A flaw found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function.
While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability.
This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.

References:
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a

Comment 3 Alex 2023-06-04 14:35:58 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2212180]

Comment 5 Justin M. Forbes 2023-06-05 12:35:19 UTC

This was fixed for Fedora with the 6.1.16 stable kernel updates.

Comment 9 Laszlo Ersek 2023-07-31 16:46:25 UTC

[PATCH 0/2] tun/tap: set sk_uid from current_fsuid()
Message-Id: <20230731164237.48365-1-lersek>
https://lore.kernel.org/all/20230731164237.48365-1-lersek@redhat.com/

Comment 12 errata-xmlrpc 2023-11-07 08:20:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583