Security Advisory: CSF Firewall Port Rule Race Condition
A race condition in ConfigServer Security & Firewall (CSF) port rule handling is fixed in this security release: under concurrent reloads, a port rule could briefly apply incorrectly, exposing management ports at the wrong moment. Reinstall CSF from ConfigServer and restart the firewall.
Betroffene Versionen
CSF 14.20 and earlier
Gepatchte Version
CSF 14.21
Standard-Update-Befehl
yum update -yFix-Befehle
AlmaLinux 9 / CloudLinux 9
cd /etc/csf
csf -u
csf -rAlmaLinux 8 / CloudLinux 8
cd /etc/csf
csf -u
csf -rCentOS 7 / CloudLinux 7
cd /etc/csf
csf -u
csf -rWas das unter einer SharedLicense-Lizenz bedeutet
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
CSF applies its port rules by regenerating and reloading firewall configuration. The race condition meant two overlapping reloads could interleave, leaving a rule in the wrong state — in the worst case, a management port that should be closed stayed open until the next clean reload.
Who is affected
Servers running CSF where rules change automatically (login failures, cluster updates) — the overlap windows are exactly those automatic flows.
How to apply the fix
- Reinstall CSF from the ConfigServer distribution:
csf.tgz, thencsf -rto reload rules cleanly. - Verify listening ports against
csf.confexpectations after the reload.
For SharedLicense customers
Licensing is unaffected — CSF is free firewall software. This is a low-severity fix; apply it in the regular maintenance window.
Häufig gestellte Fragen
What is the CSF race condition?
How do I apply the fix?
How serious is it?
Referenzen
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen