From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C706F1B87D6 for ; Tue, 21 Jan 2025 12:01:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737460914; cv=none; b=JWDpen/fpBHfjWbaTMuVQpGnnLyG0cf85ZCiQwROhNGgWg7P4TSAXllVbqGIZOmB8Mis4up2jPFekdMkFoZ1ILU2WQkODOT9mbtbJzLfqY/0kXHSPf7lgWdYUY+yrbKM3e8dc4SBqOWkK9E+DhIR/nEFdfI5zg2/US/LvrUfm08= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737460914; c=relaxed/simple; bh=UuDrjD541TPJ4s+zDGtHArVd2KQBWsBco53AjPLDXnw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Xy82mW80FguyG7C0KHPphYz7fDluTp0jay4A8HnFd1xs+3vLfAuWmop+2D8PVl2aJKnSnJaf55FfUurR6jXZRmeWWsF7iheA+FA2aePiwVAf2N/X0bKyU9Zds2qaubp8BxrV6/u44BOS1Q8qqTJ9vageU15fvnh0eAC0GSw8Jno= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rex80Iny; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Rex80Iny" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A005EC4CEDF; Tue, 21 Jan 2025 12:01:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1737460914; bh=UuDrjD541TPJ4s+zDGtHArVd2KQBWsBco53AjPLDXnw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Rex80InyZ5lW7hv240VFXjHxG5Ie/MZ7y9OScMS/PhA4V4Bs1JTNOuHDZkCmB1hmj QMwS++zzjD8Et6rfWXPaaifoJ56J4MG17bIFDKc4q6v7ByoV0hCMXt9X7eHLLa65KE UhWkmkF9OaFGMflf0BN7nluG8Obfq1BuD5jwDQOI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-57931: selinux: ignore unknown extended permissions Date: Tue, 21 Jan 2025 13:01:45 +0100 Message-ID: <2025012147-CVE-2024-57931-06fb@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3086; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=UuDrjD541TPJ4s+zDGtHArVd2KQBWsBco53AjPLDXnw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn9PatPXptrt7nMMit4Wuy+2ienL2g2PPmsMb9i/qrCq kxd5X1dHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARu0qG+XmXAm4pWU59WmFq pdmQxaE4e1ciK8OC5alaDb9u6EkJTdsWorqo/vypZZwCAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. The Linux kernel CVE team has assigned CVE-2024-57931 to this issue. Affected and fixed versions =========================== Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 5.4.289 with commit f45a77dd24ae9ddb474303ec3975c376bd99fc51 Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 5.10.233 with commit 712137b177b45f255ce5687e679d950fcb218256 Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 5.15.176 with commit f70e4b9ec69d9a74b84c17767a9a4eda8c901021 Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 6.1.124 with commit c79324d42fa48372e0acb306a2761cc642bd4db0 Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 6.6.70 with commit c1dbd28a079553de0023e1c938c713efeeee400f Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 6.12.9 with commit efefe36c03a73bb81c0720ce397659a5051b73fa Issue introduced in 4.3 with commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a and fixed in 6.13 with commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57931 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: security/selinux/ss/services.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f45a77dd24ae9ddb474303ec3975c376bd99fc51 https://git.kernel.org/stable/c/712137b177b45f255ce5687e679d950fcb218256 https://git.kernel.org/stable/c/f70e4b9ec69d9a74b84c17767a9a4eda8c901021 https://git.kernel.org/stable/c/c79324d42fa48372e0acb306a2761cc642bd4db0 https://git.kernel.org/stable/c/c1dbd28a079553de0023e1c938c713efeeee400f https://git.kernel.org/stable/c/efefe36c03a73bb81c0720ce397659a5051b73fa https://git.kernel.org/stable/c/900f83cf376bdaf798b6f5dcb2eae0c822e908b6