GHSA-vv6c-69r6-chg9: Github.com/landlock lsm/go landlock Go-Landlock Vulnerability
LOWGHSA-vv6c-69r6-chg9 is a LOW go-landlock vulnerability (General Security Weakness) affecting Github.com/landlock lsm/go landlock libraries in the Go ecosystem. The issue involves go-landlock in best-effort mode did not restrict tcp bind and connect operations correctly. Remediation is available by upgrading affected packages to version 0.0.0-20241013234402-fb3ad845df46.
GHSA-vv6c-69r6-chg9 at a Glance
How to Fix GHSA-vv6c-69r6-chg9
To remediate this vulnerability, upgrade all affected Github.com/landlock lsm/go landlock dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/landlock-lsm/go-landlock to 0.0.0-20241013234402-fb3ad845df46Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/landlock-lsm/go-landlockHow to Check if You Are Affected
To determine whether your application is affected by GHSA-vv6c-69r6-chg9, inspect your project dependencies for Github.com/landlock lsm/go landlock:
inspect dependencies for github.com/landlock-lsm/go-landlockAnalyze the terminal output to locate any version of Github.com/landlock lsm/go landlock in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20241013234402-fb3ad845df46), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Github.com/landlock lsm/go landlock, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-vv6c-69r6-chg9 Affected Github.com/landlock lsm/go landlock Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/landlock-lsm/go-landlock
|
Go |
≥ 0.0.0-20240109
< 0.0.0-20241013234402-fb3ad845df46
|
0.0.0-20241013234402-fb3ad845df46
|
References
Frequently Asked Questions
What is GHSA-vv6c-69r6-chg9?
Which Github.com/landlock lsm/go landlock versions are affected?
What version fixes GHSA-vv6c-69r6-chg9?
Is github.com/landlock-lsm/go-landlock affected?
What CWE is associated with GHSA-vv6c-69r6-chg9?
How can I check Go dependencies for GHSA-vv6c-69r6-chg9?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-vv6c-69r6-chg9",
"modified" : "2024-10-14T20:30:25Z",
"published" : "2024-10-14T20:30:25Z",
"aliases" : [ ],
"summary" : "Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly",
"details" : "### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/landlock-lsm/go-landlock"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.0.0-20240109"
}, {
"fixed" : "0.0.0-20241013234402-fb3ad845df46"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/landlock-lsm/go-landlock/security/advisories/GHSA-vv6c-69r6-chg9"
}, {
"type" : "WEB",
"url" : "https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/landlock-lsm/go-landlock"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2024-10-14T20:30:25Z",
"nvd_published_at" : null
}
}