Conntrack Garbage Collection Vulnerability in Linux Kernel - CVE-2022-49110
Summary
CVE-2022-49110: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 ("netfilter: conntrack: collect all entries in one cycle") conntrack gc was change... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The conntrack subsystem within the kernel is responsible for tracking network connections, which is crucial for firewall and network security operations. This vulnerability affects the conntrack garbage collection (gc) mechanism, which is vital for maintaining the efficiency and performance of network operations.
Vulnerability Detail
CVE-2022-49110 is a vulnerability in the Linux kernel's netfilter conntrack subsystem that arises from changes made to the garbage collection process. The gc was modified to run every 2 minutes, which can lead to netlink event overflows when events are collected, particularly on systems with large conntrack hash tables. This overflow can result in denial of service conditions, as the system may become overwhelmed with excessive events, leading to potential instability and security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can reduce the size of the conntrack hash table to minimize the impact of the garbage collection process. This can be done by adjusting the sysctl settings. For example, you can run the following command: 'sysctl -w net.netfilter.nf_conntrack_hashsize=<smaller_value>'. Replace <smaller_value> with a value that suits your system's needs.
Conclusion
CVE-2022-49110 is a significant vulnerability in the Linux kernel's conntrack subsystem that can lead to system instability due to netlink event overflows. It is crucial for users to update their systems to the patched version to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49110 is a vulnerability in the Linux kernel's conntrack subsystem that can lead to netlink event overflows and potential denial of service.
This vulnerability can cause your system to become unstable due to excessive netlink events, potentially leading to service interruptions.
The vulnerability affects Linux kernel versions prior to 5.17.3-1 on Debian systems, including Debian 11, 12, and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, consider applying the recommended workaround to reduce the conntrack hash table size until you can perform the update.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
