{"id":"GHSA-vv6c-69r6-chg9","summary":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","details":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","aliases":["GO-2024-3199"],"modified":"2024-10-15T16:12:13.340667Z","published":"2024-10-14T20:30:25Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2024-10-14T20:30:25Z","nvd_published_at":null,"cwe_ids":[]},"references":[{"type":"WEB","url":"https://github.com/landlock-lsm/go-landlock/security/advisories/GHSA-vv6c-69r6-chg9"},{"type":"WEB","url":"https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b"},{"type":"PACKAGE","url":"https://github.com/landlock-lsm/go-landlock"}],"affected":[{"package":{"name":"github.com/landlock-lsm/go-landlock","ecosystem":"Go","purl":"pkg:golang/github.com/landlock-lsm/go-landlock"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20240109"},{"fixed":"0.0.0-20241013234402-fb3ad845df46"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-vv6c-69r6-chg9/GHSA-vv6c-69r6-chg9.json"}}],"schema_version":"1.9.0"}