CVE-2024-47685

A flaw was found in the Netfilter and IPV6 functionality in the Linux kernel leading to a leak of 4 random bits. This issue may allow a remote user to preform an unauthorized read of random bits from the server.

This issue is considered to be a moderate impact flaw, as the leaked data is a tcp stack and not the whole kernel. It does not seem to affect the availability. A remote user can potentially read 4 bits of random data from the server memory, but has no control of what is in the 4 bits and cannot bring any harm to the server from it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If IPV6 or netfilter is not being used, then the issue is not applicable.

In order to trigger this issue, the local user needs to enable Netfilter and IPV6 (that requires the ability to create user/net namespaces).

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:

echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf

sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as this functionality needs to be enabled.