RHSA-2022:4942

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.

The given exploit needs CAP_NET_ADMIN to set up IPsec SA and a user namespace is used to get that capability, so disabling unprivileged user namespaces gives some protection. ~~~ On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. ~~~ Note: If the target system is already using IPsec and has SA configured, then no additional privileges are needed to exploit the issue.