Memory Allocation Vulnerability in Linux Kernel's ipset Package
Summary
CVE-2022-49911: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: enforce documented limit to prevent allocating huge memory Daniel Xu reported that the hash:net,iface type of the ipset subsystem does... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. The ipset subsystem allows users to create and manage sets of IP addresses, networks, or ports for efficient packet filtering. This functionality is crucial for firewall configurations and network security. However, a recent vulnerability has been identified in the ipset subsystem, specifically affecting the hash:net,iface type, which can lead to excessive memory usage.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49911, arises from the lack of a limit on adding the same network with different interfaces to an ipset set. This oversight can result in significant memory consumption or allocation failures, potentially leading to system instability. The issue was reported by Daniel Xu and can be exploited by creating a large number of entries in an ipset, causing the system to attempt to allocate an excessive amount of memory, which exceeds the available resources.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid creating ipset sets with the hash:net,iface type that include the same network prefix with multiple interfaces. This can be done by limiting the number of interfaces used in ipset commands, as shown in the following example: $ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0. Ensure that you do not exceed the documented limit of 64 different interfaces.
Conclusion
The CVE-2022-49911 vulnerability in the Linux kernel's ipset subsystem poses a significant risk due to its potential for excessive memory allocation. Users are advised to update their systems to the latest patched version to ensure security and stability. Additionally, temporary workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49911 is a vulnerability in the Linux kernel's ipset subsystem that allows excessive memory allocation when adding the same network with different interfaces.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential system instability due to excessive memory usage or allocation failures, which can lead to crashes or degraded performance.
Yes, a patch is available. Users should update their Linux kernel to version 6.0.8-1 or later to mitigate the vulnerability.
If an immediate update is not possible, avoid using the ipset hash:net,iface type with multiple interfaces for the same network prefix as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.