{"id":"GHSA-vv6c-69r6-chg9","aliases":["GO-2024-3199"],"url":"https://o3.security/vulnerability/GHSA-vv6c-69r6-chg9","summary":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","details":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","published":"2024-10-14T20:30:25Z","modified":"2024-10-15T16:12:13.340667Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/landlock-lsm/go-landlock","fixedVersion":"0.0.0-20241013234402-fb3ad845df46"}],"fix":{"url":"https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b","label":"landlock-lsm/go-landlock@fb3ad84"},"references":[{"type":"WEB","url":"https://github.com/landlock-lsm/go-landlock/security/advisories/GHSA-vv6c-69r6-chg9"},{"type":"WEB","url":"https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b"},{"type":"PACKAGE","url":"https://github.com/landlock-lsm/go-landlock"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-10-15T16:12:13.340667Z"}}