Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply: They use Landlock rulesets that are supposed to restrict networking (through landlock.V4, landlock.V5, or self-configured). These Landlock rulesets are used in best-effort mode. Typically, affected code uses the Go-Landlock API like this (the crucial part being the combination of V4/V5 and .BestEffort()): This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings. The bug only affects networking restrictions. File system restrictions continue to work as expected. Patches Patched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b Users should upgrade to: v0.0.0-20241013234402-fb3ad845df46 Go package dependencies can be updated using go get -u from…

Published by the source

14 Oct 2024, 20:30 UTC

Last modified by the source

14 Oct 2024, 20:30 UTC

Source last checked

26 Oct 2026, 15:05 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vv6c-69r6-chg9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-vv6c-69r6-chg9

Advisory: Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly
IDs: GHSA-vv6c-69r6-chg9
Record: https://patchnext.com/advisories/ghsa-vv6c-69r6-chg9 (revision 1, source checked 26 Oct 2026, 15:05 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/landlock-lsm/go-landlock 0.0.0-20241013234402-fb3ad845df46. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/landlock-lsm/go-landlock: affected >= 0.0.0-20240109, < 0.0.0-20241013234402-fb3ad845df46; fixed in 0.0.0-20241013234402-fb3ad845df46

## Suggested inspection (read-only)
- Go github.com/landlock-lsm/go-landlock: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/landlock-lsm/go-landlock.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vv6c-69r6-chg9 (GitHub-reviewed advisory GHSA-vv6c-69r6-chg9 lists affected ranges: Go github.com/landlock-lsm/go-landlock >=0.0.0-20240109 <0.0.0-20241013234402-fb3ad845df46)

Commands are suggestions: review each one before running it.