Security Advisory: CSF Firewall Port Rule Race Condition
A race condition in ConfigServer Security & Firewall (CSF) port rule handling is fixed in this security release: under concurrent reloads, a port rule could briefly apply incorrectly, exposing management ports at the wrong moment. Reinstall CSF from ConfigServer and restart the firewall.
Затронутые версии
CSF 14.20 and earlier
Исправленная версия
CSF 14.21
Команда обновления по умолчанию
yum update -yКоманды исправления
AlmaLinux 9 / CloudLinux 9
cd /etc/csf
csf -u
csf -rAlmaLinux 8 / CloudLinux 8
cd /etc/csf
csf -u
csf -rCentOS 7 / CloudLinux 7
cd /etc/csf
csf -u
csf -rЧто это значит по лицензии SharedLicense
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
CSF applies its port rules by regenerating and reloading firewall configuration. The race condition meant two overlapping reloads could interleave, leaving a rule in the wrong state — in the worst case, a management port that should be closed stayed open until the next clean reload.
Who is affected
Servers running CSF where rules change automatically (login failures, cluster updates) — the overlap windows are exactly those automatic flows.
How to apply the fix
- Reinstall CSF from the ConfigServer distribution:
csf.tgz, thencsf -rto reload rules cleanly. - Verify listening ports against
csf.confexpectations after the reload.
For SharedLicense customers
Licensing is unaffected — CSF is free firewall software. This is a low-severity fix; apply it in the regular maintenance window.
Часто задаваемые вопросы
What is the CSF race condition?
How do I apply the fix?
How serious is it?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему