CVE-2024-42318: landlock: Don't lose track of restrictions on cred_transfer
In the Linux kernel, the following vulnerability has been resolved:
landlock: Don't lose track of restrictions on cred_transfer
When a process' cred struct is replaced, this _almost_ always invokes
the cred_prepare LSM hook; but in one special case (when
KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the
cred_transfer LSM hook is used instead. Landlock only implements the
cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes
all information on Landlock restrictions to be lost.
This basically means that a process with the ability to use the fork()
and keyctl() syscalls can get rid of all Landlock restrictions on
itself.
Fix it by adding a cred_transfer hook that does the same thing as the
existing cred_prepare hook. (Implemented by having hook_cred_prepare()
call hook_cred_transfer() so that the two functions are less likely to
accidentally diverge in the future.)
Security readout for executives and security teams
Plain-English summary
A local process confined by Linux Landlock can discard its Landlock restrictions by triggering a special credentials transfer. This defeats that sandbox layer and may expose files or operations Landlock was intended to protect. It does not, by itself, remove other Linux permission controls or automatically grant root access.
Executive priority
Prioritize systems where Landlock protects untrusted code, developer sandboxes, or multi-tenant workloads. Patch those promptly because the flaw can nullify the intended confinement layer. Systems not using Landlock have substantially lower direct exposure, but kernel inventory and vendor-status confirmation remain appropriate.
Technical view
Landlock handled the cred_prepare LSM hook but not cred_transfer. KEYCTL_SESSION_TO_PARENT uses cred_transfer when replacing a parent process’s credentials, causing Landlock state to be lost. A process able to invoke fork() and keyctl() can therefore remove its own Landlock restrictions. The kernel fix adds equivalent handling for credential transfers.
Likely exposure
Exposure is concentrated on Linux systems using Landlock to confine potentially untrusted local processes. Risk requires the confined process to access fork() and keyctl(). The supplied version data identifies Linux 5.13 and several later release lines, but its exact affected-versus-fixed boundaries are ambiguous; verify the running distribution kernel against vendor advisories and linked fixes.
Exploitation context
Exploitation is local, low-complexity, requires low privileges, and needs no user interaction according to CVSS 3.1. The source bundle does not show CISA KEV listing or evidence of active exploitation. Public technical discussion exists, but that alone does not establish attacks in the wild.
Researcher notes
The failure occurs during the exceptional KEYCTL_SESSION_TO_PARENT credential path, where cred_transfer replaces the usually invoked cred_prepare hook. The remediation makes Landlock state propagation consistent across both paths. Treat the supplied release list cautiously: it does not clearly distinguish vulnerable endpoints from fixed stable releases, so commit or distributor verification is necessary.
Mitigation direction
Install a vendor-supported kernel containing the applicable linked Landlock cred_transfer fix.
Check distribution security advisories because backported kernel versions may not match upstream numbering.
Until patched, avoid treating Landlock as the sole security boundary for untrusted local workloads.
Where operationally safe, limit untrusted workloads’ access to keyctl() to reduce exposure.
Validation and detection
Inventory running kernel versions and identify workloads that actively enable Landlock restrictions.
Compare each distribution kernel with vendor advisories and the applicable upstream stable fix.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-42318 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.