GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-42318 (GCVE-0-2024-42318)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36
VLAI
Title
landlock: Don't lose track of restrictions on cred_transfer
Summary
In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost. This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself. Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.)
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:09 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 , < 916c648323fa53b89eedb34a0988ddaf01406117 (git)
Affected: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 , < 0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c (git)
Affected: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 , < 16896914bace82d7811c62f3b6d5320132384f49 (git)
Affected: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 , < b14cc2cf313bd29056fadbc8ecd7f957cf5791ff (git)
Affected: 385975dca53eb41031d0cbd1de318eb1bc5d6bb9 , < 39705a6c29f8a2b93cf5b99528a55366c50014d1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.103 , ≤ 6.1.* (semver)
Unaffected: 6.6.44 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:37.227Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:35.795087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:26.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/cred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117",
              "status": "affected",
              "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
              "versionType": "git"
            },
            {
              "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c",
              "status": "affected",
              "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
              "versionType": "git"
            },
            {
              "lessThan": "16896914bace82d7811c62f3b6d5320132384f49",
              "status": "affected",
              "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
              "versionType": "git"
            },
            {
              "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff",
              "status": "affected",
              "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
              "versionType": "git"
            },
            {
              "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1",
              "status": "affected",
              "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/cred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don\u0027t lose track of restrictions on cred_transfer\n\nWhen a process\u0027 cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0027s credentials), the\ncred_transfer LSM hook is used instead.  Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing local syscalls (`fork()` plus `keyctl(KEYCTL_JOIN_SESSION_KEYRING)` / `keyctl(KEYCTL_SESSION_TO_PARENT)`) on the target system; there is no remote or adjacent-network entry point into the credential-transfer path.\nAC:L - The attacker controls every precondition \u2014 the parent/child relationship, single-threadedness, matching uid/gid, and the distinct session keyrings \u2014 and the upstream selftest demonstrates the escape is 100% deterministic with no race, memory-layout, or timing dependency.\nPR:L - Only the ability to run code as an ordinary local user is needed; Landlock sandboxing and `keyctl()` are entirely unprivileged (the selftest explicitly calls `drop_caps()` before reproducing the escape), and in fact the attacker starts from a *less*-than-normal privilege level inside the sandbox.\nUI:N - The \"victim\" whose credentials are rewritten is the attacker\u0027s own parent process, driven entirely by the attacker\u0027s task_work; no action by any other user is required.\nS:C - This is a sandbox escape \u2014 the confined process breaks out of the Landlock domain imposed by a separate security authority (the sandboxing supervisor/policy), gaining access to filesystem and network resources managed outside the vulnerable component\u0027s security scope.\nC:H - All Landlock restrictions are dropped at once, so the escaped process can read every file and directory the policy was specifically deployed to hide from it, a total loss of the confidentiality guarantee of the impacted component.\nI:H - The escape restores unrestricted write, create, rename, link and (ABI 3+) truncate access plus network bind/connect, letting the process arbitrarily modify data the sandbox policy protected.\nA:H - With every restriction removed the process can delete and truncate files the Landlock policy existed to protect, destroying the availability of the sandboxed resources; the protection is permanently and completely lost for the lifetime of the process and all its descendants."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:37.407Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"
        },
        {
          "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"
        },
        {
          "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"
        },
        {
          "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"
        },
        {
          "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"
        }
      ],
      "title": "landlock: Don\u0027t lose track of restrictions on cred_transfer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42318",
    "datePublished": "2024-08-17T09:09:31.160Z",
    "dateReserved": "2024-07-30T07:40:12.278Z",
    "dateUpdated": "2026-08-05T11:36:37.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42318",
      "date": "2026-09-19",
      "epss": "0.00299",
      "percentile": "0.2281"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don\u0027t lose track of restrictions on cred_transfer\n\nWhen a process\u0027 cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0027s credentials), the\ncred_transfer LSM hook is used instead.  Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: landlock: no pierda de vista las restricciones en cred_transfer Cuando se reemplaza la estructura cred de un proceso, esto _almost_ always invoca el gancho LSM cred_prepare; pero en un caso especial (cuando KEYCTL_SESSION_TO_PARENT actualiza las credenciales de los padres), se utiliza el gancho LSM cred_transfer. Landlock solo implementa el gancho cred_prepare, no cred_transfer, por lo que KEYCTL_SESSION_TO_PARENT hace que se pierda toda la informaci\u00f3n sobre las restricciones de Landlock. B\u00e1sicamente, esto significa que un proceso con la capacidad de utilizar las llamadas al sistema fork() y keyctl() puede deshacerse de todas las restricciones de Landlock sobre s\u00ed mismo. Solucionelo agregando un gancho cred_transfer que haga lo mismo que el gancho cred_prepare existente. (Se implementa haciendo que hook_cred_prepare() llame a hook_cred_transfer() para que sea menos probable que las dos funciones diverjan accidentalmente en el futuro)."
        }
      ],
      "id": "CVE-2024-42318",
      "lastModified": "2024-11-21T09:33:52.177",
      "published": "2024-08-17T09:15:11.700",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/landlock/cred.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117",
                    "status": "affected",
                    "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c",
                    "status": "affected",
                    "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16896914bace82d7811c62f3b6d5320132384f49",
                    "status": "affected",
                    "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff",
                    "status": "affected",
                    "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1",
                    "status": "affected",
                    "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/landlock/cred.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C9AF5ED3-AC3F-4864-B907-F7C809A8995E",
                    "versionEndExcluding": "5.15.165",
                    "versionStartIncluding": "5.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E45EAC72-8329-4F99-8276-86AF9BB3496A",
                    "versionEndExcluding": "6.1.103",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC912330-6B41-4C6B-99AF-F3857FBACB6A",
                    "versionEndExcluding": "6.6.44",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92D388F2-1EAF-4CFA-AC06-5B26D762EA7D",
                    "versionEndExcluding": "6.10.3",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don\u0027t lose track of restrictions on cred_transfer\n\nWhen a process\u0027 cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0027s credentials), the\ncred_transfer LSM hook is used instead.  Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: landlock: no pierda de vista las restricciones en cred_transfer Cuando se reemplaza la estructura cred de un proceso, esto _almost_ always invoca el gancho LSM cred_prepare; pero en un caso especial (cuando KEYCTL_SESSION_TO_PARENT actualiza las credenciales de los padres), se utiliza el gancho LSM cred_transfer. Landlock solo implementa el gancho cred_prepare, no cred_transfer, por lo que KEYCTL_SESSION_TO_PARENT hace que se pierda toda la informaci\u00f3n sobre las restricciones de Landlock. B\u00e1sicamente, esto significa que un proceso con la capacidad de utilizar las llamadas al sistema fork() y keyctl() puede deshacerse de todas las restricciones de Landlock sobre s\u00ed mismo. Solucionelo agregando un gancho cred_transfer que haga lo mismo que el gancho cred_prepare existente. (Se implementa haciendo que hook_cred_prepare() llame a hook_cred_transfer() para que sea menos probable que las dos funciones diverjan accidentalmente en el futuro)."
          }
        ],
        "id": "CVE-2024-42318",
        "lastModified": "2026-08-04T11:19:52.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-42318",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:35.795087Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-17T09:15:11.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:18:28+00:00",
      "cve": "CVE-2024-42318",
      "id": "CVE-2024-42318",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: landlock: Don\u0026#39;t lose track of restrictions on cred_transfer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42318.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T02:24:08Z",
      "cve": "CVE-2024-42318",
      "id": "CVE-2024-42318",
      "initial_release_date": "2024-08-18T02:02:08Z",
      "product_status:known_affected": "407",
      "product_status:known_not_affected": "219",
      "product_status:recommended": "643",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42318",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42318.json",
      "version": "71"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:04:37.227Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-42318",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:09:35.795087Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:23.367Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "security/landlock/cred.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117",
                  "status": "affected",
                  "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                  "versionType": "git"
                },
                {
                  "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c",
                  "status": "affected",
                  "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                  "versionType": "git"
                },
                {
                  "lessThan": "16896914bace82d7811c62f3b6d5320132384f49",
                  "status": "affected",
                  "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                  "versionType": "git"
                },
                {
                  "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff",
                  "status": "affected",
                  "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                  "versionType": "git"
                },
                {
                  "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1",
                  "status": "affected",
                  "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "security/landlock/cred.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.13"
                },
                {
                  "lessThan": "5.13",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.165",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.103",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.44",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.165",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.103",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.44",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.3",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don\u0027t lose track of restrictions on cred_transfer\n\nWhen a process\u0027 cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0027s credentials), the\ncred_transfer LSM hook is used instead.  Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Exploitation requires executing local syscalls (`fork()` plus `keyctl(KEYCTL_JOIN_SESSION_KEYRING)` / `keyctl(KEYCTL_SESSION_TO_PARENT)`) on the target system; there is no remote or adjacent-network entry point into the credential-transfer path.\nAC:L - The attacker controls every precondition \u2014 the parent/child relationship, single-threadedness, matching uid/gid, and the distinct session keyrings \u2014 and the upstream selftest demonstrates the escape is 100% deterministic with no race, memory-layout, or timing dependency.\nPR:L - Only the ability to run code as an ordinary local user is needed; Landlock sandboxing and `keyctl()` are entirely unprivileged (the selftest explicitly calls `drop_caps()` before reproducing the escape), and in fact the attacker starts from a *less*-than-normal privilege level inside the sandbox.\nUI:N - The \"victim\" whose credentials are rewritten is the attacker\u0027s own parent process, driven entirely by the attacker\u0027s task_work; no action by any other user is required.\nS:C - This is a sandbox escape \u2014 the confined process breaks out of the Landlock domain imposed by a separate security authority (the sandboxing supervisor/policy), gaining access to filesystem and network resources managed outside the vulnerable component\u0027s security scope.\nC:H - All Landlock restrictions are dropped at once, so the escaped process can read every file and directory the policy was specifically deployed to hide from it, a total loss of the confidentiality guarantee of the impacted component.\nI:H - The escape restores unrestricted write, create, rename, link and (ABI 3+) truncate access plus network bind/connect, letting the process arbitrarily modify data the sandbox policy protected.\nA:H - With every restriction removed the process can delete and truncate files the Landlock policy existed to protect, destroying the availability of the sandboxed resources; the protection is permanently and completely lost for the lifetime of the process and all its descendants."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:36:37.407Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"
            },
            {
              "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"
            },
            {
              "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"
            },
            {
              "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"
            },
            {
              "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"
            },
            {
              "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"
            },
            {
              "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"
            },
            {
              "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"
            }
          ],
          "title": "landlock: Don\u0027t lose track of restrictions on cred_transfer",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-42318",
        "datePublished": "2024-08-17T09:09:31.160Z",
        "dateReserved": "2024-07-30T07:40:12.278Z",
        "dateUpdated": "2026-08-05T11:36:37.407Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.