Security Bulletins

Summary

Red Hat Enterprise Linux RHEL 9.4 kernels mishandle certain netfilter-queue operations bypassing egress network policy when domain name based (DNS) rules are in use.

Severity

High

Affected Releases

All current Calico Enterprise and Cloud releases

Affected Platforms

RedHat Enterprise Linux Release 9.4 with kernel version less than 5.14.0-427.42.1.el9_4
Any distribution using Linux 6.7 derived kernel

Indications of Compromise/Impact

Unintended allowed egress traffic from pods or servers that have domain name based (DNS) rules.

Problem Details

The affected kernels do not properly handle the NF_REPEAT verdict when a packet that has matched an NFQUEUE action in iptables is returned to the kernel.

In the default (for the iptables data plane) dnsPolicyMode of DelayDeniedPacket, this causes traffic that is evaluated by a domain based (DNS) rule to always be allowed.

Note that DNS policy rules are only supported in egress policy: ingress policy is unaffected and will still behave normally. Policy evaluated before the first DNS rule for the source is unaffected.

Policy evaluated before the first DNS rule for the source is unaffected. Once traffic is evaluated against a DNS rule as it passes through tiers, policies, and rules, it will be allowed regardless of the intended policy.

Workaround / Remediation

The current remediation is:

• Roll back to RHEL 9.3.

Fixed Software

Red Hat corrected the issue in the kernel release 5.14.0-427.42.1.el9_4.

We have identified the following kernels as impacted:

• Mainline kernel version 6.7
• All RHEL 9.4 kernels with version prior 5.14.0-427.

The following kernels are either unaffected by the bug or already include the necessary fix:

• Any other RHEL version (including 9.0 through 9.3 and 9.5)
• RHEL 9.4 with kernels 5.14.0-427 and beyond
• No Ubuntu release used a 6.7 based kernel, and we can confirm 24.04 is unaffected
• Mainline kernel versions 6.6 and before, or 6.8 and later

For any questions, contact us at support@tigera.io