{"id":"GHSA-vv6c-69r6-chg9","aliases":["GO-2024-3199"],"status":"published","title":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","description":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-10-14T20:30:25Z","modified":"2024-10-15T16:12:13Z","fixes":[{"ecosystem":"Go","package":"github.com/landlock-lsm/go-landlock","fixed_in":["0.0.0-20241013234402-fb3ad845df46"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/landlock-lsm/go-landlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0-20240109"},{"fixed":"0.0.0-20241013234402-fb3ad845df46"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/landlock-lsm/go-landlock","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20240109"},{"fixed":"0.0.0-20241013234402-fb3ad845df46"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/landlock-lsm/go-landlock","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20241013234402-fb3ad845df46"}]}]}],"references":[{"url":"https://github.com/landlock-lsm/go-landlock/security/advisories/GHSA-vv6c-69r6-chg9","tags":["web","advisory"]},{"url":"https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-vv6c-69r6-chg9"},{"url":"https://github.com/landlock-lsm/go-landlock","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vv6c-69r6-chg9","title":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","description":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","status":"published","published":"2024-10-14T20:30:25Z","modified":"2024-10-14T20:30:27Z","updated_at":"2026-11-02T14:38:10.696798Z"}],"osv":[{"id":"GHSA-vv6c-69r6-chg9","title":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","description":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","status":"published","published":"2024-10-14T20:30:25Z","modified":"2024-10-15T16:12:13.340667Z","updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"GO-2024-3199","title":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock","description":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","status":"published","published":"2024-10-15T15:42:40Z","modified":"2024-10-15T16:12:13.340667Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}