CVE-2021-43267
highpriority · attend · 69EPSS 0.579 · 99 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-22
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedbpftool-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-0:4.18.0-348.2.1.el8_5.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-abi-stablelists-0:4.18.0-348.2.1.el8_5.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-core-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-core-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-core-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-core-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-core-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-core-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-aarch64-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-s390x-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-debuginfo-common-x86_64-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-doc-0:4.18.0-348.2.1.el8_5.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-extra-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-extra-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-modules-extra-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedkernel-zfcpdump-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedperf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Fixedpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2021:4647 - Workaroundbpftool-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundbpftool-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-0:4.18.0-348.2.1.el8_5.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-abi-stablelists-0:4.18.0-348.2.1.el8_5.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-core-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-core-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-core-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-core-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-core-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-core-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debug-modules-extra-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-s390x-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-doc-0:4.18.0-348.2.1.el8_5.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-extra-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-extra-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-modules-extra-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-tools-libs-devel-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-core-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-devel-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-modules-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundperf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
- Workaroundpython3-perf-debuginfo-0:4.18.0-348.2.1.el8_5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec): - BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 1) On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user */ #define TOP_SRV 15 /* pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); } 2) Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages). 3) Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L <module>" on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- DarkSprings/CVE-2021-43267-POCtrusty poc Provide it to legitimate peoplePoC · poc_in_github
- zzhacked/CVE-2021-43267Local PoC exploit for CVE-2021-43267 (Linux TIPC)PoC · poc_in_github
affected products (144)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- RHSA-2021:4647Red Hat Security Advisory: kernel security update2021-11-15csaf · redhat_csafUS
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2022-0112Google Android: Mehrere Schwachstellen ermöglichen PrivilegieneskalationDeutsch2022-03-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, beliebigen Code zur Ausführung zu bringen und einen Denial-of-Service-Zustand auszulösen.
- PUB-A-2052434142022-03-01vendor · osvUS
In tipc_crypto_key_rcv of net/tipc/crypto.c , there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (39)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/02/10/1cnnvd
- https://access.redhat.com/security/cve/cve-2021-43267cnnvd
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16cnnvd
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16。Patchcnnvd
- https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVWL7HZV5T5OEKJPO2D67RMFMKBBXGGB/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-43267cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan