CVE-2024-42318

What it actually does

Landlock LSM fails to preserve restriction state during credential replacement via the cred_transfer hook (used by KEYCTL_SESSION_TO_PARENT), allowing a process to drop all Landlock rules while retaining the ability to call fork() and keyctl().

Why it matters to the business

Attackers or malicious code can evade mandatory access controls on Linux systems, increasing the chance of unauthorized file access, privilege escalation, or persistence; high downstream prevalence amplifies exposure across many distributions and containers.

How an attack unfolds

An attacker with fork() and keyctl() access invokes KEYCTL_SESSION_TO_PARENT to trigger cred_transfer instead of cred_prepare; because Landlock only hooks the latter, restriction metadata is lost and the process runs unrestricted. Threat actors in 2024 Zero-Day Exploitation Campaigns and Linux kernel campaigns have targeted similar kernel authorization flaws.

How to fix it

Apply the upstream kernel patch that implements the cred_transfer LSM hook (hook_cred_prepare now delegates to hook_cred_transfer). Rebuild and deploy kernels containing the fix; no urllib3 package update addresses this kernel flaw.

How to confirm the fix worked

Verify the presence of the cred_transfer hook implementation in security/landlock/cred.c after patching; confirm Landlock restrictions survive a KEYCTL_SESSION_TO_PARENT operation in a test program.

Typical attack path

1. Obtain code execution or shell access on a Landlock-protected process
2. Call fork() to create a child
3. Use keyctl(KEYCTL_SESSION_TO_PARENT, ...) to replace parent credentials
4. Confirm Landlock rules are no longer enforced
5. Perform previously blocked file or network operations

How to detect it

Review kernel audit logs for keyctl calls with KEYCTL_SESSION_TO_PARENT from processes that had Landlock domains; look for sudden absence of Landlock enforcement after credential operations in strace or eBPF traces.

What your security team should do

• Prioritize kernel updates on all systems using Landlock (high prevalence of 7,079 dependents)
• Audit workloads that grant untrusted code fork() and keyctl() capabilities
• Monitor for future Landlock-related CVEs given the recent publication and steady EPSS