Race Condition Vulnerability in Linux Kernel's Netfilter - CVE-2022-49920
Summary
CVE-2022-49920: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: netlink notifier might race to release objects commit release path is invoked via call_rcu and it runs lockless to release the obj... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used in various distributions, including Debian. The kernel's netfilter framework is responsible for packet filtering, network address translation, and other networking-related tasks. This vulnerability affects the netfilter subsystem, which is crucial for managing network traffic securely and efficiently.
Vulnerability Detail
CVE-2022-49920 is a race condition vulnerability in the Linux kernel's netfilter subsystem. It arises when the netlink notifier handler competes with the commit release path to remove objects that are still being referenced in a transaction context. This race condition can lead to unexpected behavior, including potential system crashes or data corruption, as the system may attempt to access objects that have already been released. The vulnerability is particularly concerning in environments where network traffic is heavily managed, as it could compromise the integrity of network operations.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can call rcu_barrier() to ensure that any pending RCU callbacks run to completion if there are transactions that need to be destroyed. However, this is not a permanent fix and should be replaced with the updated package as soon as possible.
Conclusion
CVE-2022-49920 represents a significant risk to systems utilizing the Linux kernel's netfilter subsystem. It is crucial to apply the necessary updates to mitigate this vulnerability and ensure the stability and security of your network operations.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49920 is a race condition vulnerability in the Linux kernel's netfilter subsystem that can lead to system instability.
It can cause unexpected behavior, including system crashes or data corruption, particularly in network management tasks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to install anything.
Implement the temporary workaround by calling rcu_barrier() to manage pending RCU callbacks until you can apply the patch.
Detailed information can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
