CVE-2009-1184 in Linux
Summary
by MITRE
The selinux_ip_postroute_iptables_compat function in security/selinux/hooks.c in the SELinux subsystem in the Linux kernel before 2.6.27.22, and 2.6.28.x before 2.6.28.10, when compat_net is enabled, omits calls to avc_has_perm for the (1) node and (2) port, which allows local users to bypass intended restrictions on network traffic. NOTE: this was incorrectly reported as an issue fixed in 2.6.27.21.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2019
The vulnerability described in CVE-2009-1184 resides within the Security-Enhanced Linux (SELinux) subsystem of the Linux kernel, specifically in the selinux_ip_postroute_iptables_compat function located in security/selinux/hooks.c. This flaw affects kernel versions prior to 2.6.27.22 and 2.6.28.x prior to 2.6.28.10, where the compat_net feature is enabled. The issue represents a critical bypass of mandatory access controls that undermines the security model designed to protect network traffic flow. The vulnerability stems from incomplete access control checks during network packet processing, creating a scenario where certain network operations can proceed without proper authorization validation.
The technical flaw manifests in the omission of crucial access control checks that should occur during the post-routing phase of network packet processing. Specifically, the function fails to invoke avc_has_perm calls for both node and port access control checks that are essential for maintaining SELinux policy enforcement. This omission occurs only when compat_net is enabled, which provides compatibility layer support for older network applications. The missing checks create a pathway where local users can circumvent network access restrictions that would normally be enforced by SELinux policies, effectively allowing unauthorized network traffic patterns to pass through the system's security controls. This behavior violates the principle of least privilege and can enable attackers to bypass network-based security controls.
The operational impact of this vulnerability is significant for systems running affected kernel versions with SELinux enabled and compat_net activated. Local users can exploit this weakness to bypass network access controls that are meant to restrict traffic flows based on security policies, potentially enabling them to establish unauthorized network connections or modify existing network communications. The vulnerability specifically affects network traffic that passes through the post-routing hook in the network stack, where packets are processed after routing decisions have been made. This allows attackers to potentially access network resources that should be restricted, potentially leading to data exfiltration, network reconnaissance, or further privilege escalation attacks. The flaw demonstrates a failure in the kernel's security module implementation where the mandatory access control enforcement mechanism is not properly invoked in all code paths.
Mitigation strategies for this vulnerability require immediate kernel upgrades to versions 2.6.27.22 or 2.6.28.10 and later, which contain the necessary patches to restore proper access control checks. Organizations should also consider disabling compat_net functionality if it is not required for legacy applications, as this removes the specific code path that triggers the vulnerability. Security administrators should review and audit SELinux policies to ensure that network access controls are properly configured and that the system's security posture remains intact. This vulnerability aligns with CWE-691, which addresses insufficient control flow protection, and maps to ATT&CK technique T1068, which involves exploiting local privilege escalation opportunities. The incident highlights the importance of thorough testing and validation of security patches in kernel components, particularly those affecting core system access control mechanisms. System administrators should also implement monitoring for unauthorized network access patterns that could indicate exploitation attempts.