CVE-2024-47659

What it actually does

Smack incorrectly mirrors the client label on returned TCP/IPv4 (and DCCP) packets instead of using the server label, violating the configured write rules and allowing a client label to receive packets labeled with its own identity even when the server label has no write authorization to it.

Why it matters to the business

Systems relying on Smack mandatory access control for network isolation between security labels can experience unauthorized cross-label data flows, increasing risk of information leakage or policy bypass on affected Linux kernels; the flaw has been present since 2.6.29.4 and affects any deployment using Smack with TCP/IPv4 listeners.

How an attack unfolds

An attacker at label 'foo' connects to a listener running at label 'bar' on a remote host where a Smack rule permits 'foo bar w'. Because the kernel mirrors the incoming label on return packets, all traffic in both directions carries the 'foo' CIPSO label, allowing the 'bar' process to write to 'foo' without authorization and without 'bar' ever being instantiated on the client.

How to fix it

Upgrade the Linux kernel to commit d3f56c653c65f170b172d3c23120bc64ada645d8 or later; rebuild and reboot with the corrected Smack TCP labeling logic. No configuration changes are required after the update.

How to confirm the fix worked

Confirm the running kernel contains commit d3f56c653c65f170b172d3c23120bc64ada645d8; reproduce the two-host test scenario and verify that return packets now carry the server label 'bar' rather than the client label 'foo'.

Typical attack path

1. Instantiate labels 'foo' and 'bar' on the server and add the rule 'foo bar w'
2. Start a TCP listener at label 'bar'
3. From a client at label 'foo', establish a TCP connection to the listener
4. Exchange data in both directions
5. Observe that all packets carry the 'foo' label, bypassing the intended write restriction

How to detect it

Inspect network captures or Smack audit logs for CIPSO labels that do not match the expected server label on established TCP connections; look for traffic patterns where a client label appears on packets originating from a server process.

What your security team should do

• Apply the kernel patch immediately on all systems using Smack
• Prioritize reboot or live-patching of internet-facing or multi-label hosts
• Review any Smack rules that rely on TCP write authorization between labels
• Monitor for downstream package updates that include the fix