SELinux Socket Permission Helper Use-After-Free in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's SELinux implementation related to socket permission helpers.

SELinux socket state is stored in a composite LSM socket blob. The functions sock_has_perm() and nlmsg_sock_has_extended_perms() currently access the SELinux socket blob by directly dereferencing sk->sk_security, assuming the SELinux socket blob is at offset zero.

However, in configurations where multiple Linux Security Modules (LSMs) are stacked, this assumption may not hold true. If another LSM allocates socket blob storage before SELinux, these functions may read the wrong blob, resulting in invalid security identifier (SID) and class values being used in access vector cache (AVC) permission checks.

The fix involves using the selinux_sock() accessor function instead of directly accessing sk->sk_security to correctly retrieve the SELinux socket blob.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause SELinux to perform incorrect permission checks on sockets due to reading invalid security data.

As a result, unauthorized access might be granted or legitimate access denied, potentially leading to security policy enforcement failures.

In environments relying on SELinux for mandatory access control, this could weaken the overall security posture by allowing unintended communication or blocking necessary communication between processes.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by using selinux_sock() instead of directly accessing sk->sk_security in the Linux kernel SELinux socket permission helpers.

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes this fix.

Useful 0 Not Useful 0