A flaw was found in the way the Linux kernel’s pfkey_dump function trusted the provided filter size parameters. A local, sufficiently privileged user could use this flaw to leak information from the kernel.

Mitigation

If the CAP_NET_ADMIN capability is privileged by default (which is true for Red Hat Enterprise Linux 7), then only an otherwise privileged user can trigger this bug.

On Red Hat Enterprise Linux 8 CAP_NET_ADMIN capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0:

echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf

sysctl -p /etc/sysctl.d/userns.conf