netfilter: conntrack: Make global sysctls readonly in non-init netns
Summary
GSD-2021-1000091: netfilter: conntrack: Make global sysctls readonly in non-init netns. Affects Kernel versions >= d0febd81ae77a0e13717f1412ff9589e43fc4f8b, < 671c54ea8c7ff47bd88444f3fffb65bf9799ce43. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a crucial component of the Linux operating system. It provides the core functionality and interfaces for the system. The netfilter subsystem within the Kernel is responsible for packet filtering, network address translation, and connection tracking. It allows administrators to define rules and policies for network traffic. However, a vulnerability has been discovered in the conntrack module of netfilter, specifically in non-init netns. This vulnerability could potentially be exploited to modify global sysctls, leading to unauthorized changes in the system's behavior.
Vulnerability Detail
The vulnerability arises from the fact that global sysctls are not properly restricted in non-init netns. This allows an attacker with sufficient privileges in a non-init netns to modify these sysctls, potentially leading to unauthorized changes in the system's behavior. The impact of such changes could range from disrupting network connectivity to compromising the security and stability of the entire system. The vulnerability was introduced in Linux Kernel version v5.7 and has been fixed in version v5.12.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to non-init netns for untrusted users or processes. This can be achieved by implementing appropriate network namespace isolation and access control measures. However, this workaround may not provide complete protection and should be considered a temporary solution until the Kernel is updated.
Conclusion
The netfilter conntrack vulnerability in non-init netns can allow unauthorized modification of global sysctls, potentially compromising the system's behavior, security, and stability. It is crucial to update the Linux Kernel to version v5.12.2 or later to mitigate this vulnerability. In the meantime, implementing network namespace isolation and access control measures can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter subsystem is a component of the Linux Kernel that provides packet filtering, network address translation, and connection tracking capabilities. It allows administrators to define rules and policies for network traffic.
This vulnerability allows an attacker with sufficient privileges in a non-init netns to modify global sysctls, potentially leading to unauthorized changes in the system's behavior. The impact could range from disrupting network connectivity to compromising the security and stability of the entire system.
This vulnerability was introduced in Linux Kernel version v5.7.
Yes, this vulnerability has been fixed in Linux Kernel version v5.12.2.
To protect your system, it is recommended to update the Linux Kernel to version v5.12.2 or later. Additionally, you can implement network namespace isolation and access control measures to restrict access to non-init netns for untrusted users or processes.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
