-2

In order to mitigate a CVE issue I have on a list of servers, I came across this link from RHEL. Under the mitigation steps, there are two options, one is to blacklist a nfs_tables kernel module which requires to follow a number of steps and a reboot, and the other which looks to me so simple is to disable user namespaces which doesn't require a reboot.

Since it's important for me to keep those servers running and to avoid errors during the execution of those steps, step 2 looks very appealing, however I don't know the total impact on the systems by disabling user namespaces. I have read that by disabling user namespaces, it could impact the functionality of containerization platforms like Docker and Podman, but since I'm not using any containerization on those servers I don't see the downside of doing that.

I would like to know if there's an important negative side effect of going that route in the case that I decide to do that so I keep that in mind. Thank you!

2
  • 4
    We can't tell you every single possible negative side effect because you haven't listed every program you are using! Namespaces are a set of system calls which are mainly used for creating containers, but can be used for doing other things like interesting routing. The best we can tell you for the short term is to read the documentation and make a judgement call. Medium term you should think how you organize things so you can handle reboots, there will be other CVEs in the next 10 years which might require you to upgrade even if your hardware lasts that long.
    – icarus
    Commented Jul 9 at 23:31
  • 1
    by the way, you an also just delete the module (if it's not yet loaded). only files that are there can be loaded… no need to blacklist something for a hotfix. Commented Jul 10 at 15:52

1 Answer 1

2

Namespaces are what drives containers, might make a lot of isolation methods possible, and might be used by daemons as additional optional layer of security.

They are quite a central piece in modern Linux userland, and are something that you usually want as something that helps you keep your system organized, separated and secure. So, disabling them to secure something else on a hunch seems very ill-advised. Especially since systemd itself heavily makes use of namespaces; not sure you could boot a system at all without heavy modifications? And: How will you "disable namespaces" if the system you're running already makes heavy use of them? Especially: how to disable systemd's use of namespaces without a reboot?

Makes no sense to me, but maybe your system is special: if sudo lsns returns no active namespaces, what you want is theoretically at least possible.

I'll also say that you need to be sure you actually need to mitigate this at all: disabling nf_tables is another terrible price to pay, it is probably necessary for your firewall.

In the meantime, have you understood the vulnerability you're mitigating?

here is the limitation that it can only be exploited by a local user with access to Netfilter

So, this is only a problem if you have local users with access to netfilter. Furthermore, a functionality-preserving solution is available: Update your kernel; The table at the end of the page lists RSHA's for various RHEL versions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .