netfilter: nf_tables: hold mutex on netns pre_exit path
Summary
GSD-2022-1002880: netfilter: nf_tables: hold mutex on netns pre_exit path. Affects Kernel versions >= 767d1216bff82507c945e92fe719dff2083bb2f4, < cc7c6e0a8e1d45955b976943dbd4ba98448ceb46. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for applications to interact with the hardware. It includes various subsystems, including netfilter, which is responsible for packet filtering and network address translation. The nf_tables component within netfilter provides a framework for configuring firewall rules and network packet processing. This vulnerability specifically impacts the nf_tables component on the pre_exit path of the network namespace. The network namespace is a feature that allows multiple instances of network stacks to coexist within the same operating system, providing isolation and separation of network resources. The vulnerability arises from a missing mutex lock on the pre_exit path, which could lead to potential security issues.
Vulnerability Detail
The vulnerability in nf_tables on the netns pre_exit path arises from a missing mutex lock. This could potentially allow concurrent access to critical data structures, leading to race conditions and security vulnerabilities. An attacker could exploit this vulnerability to manipulate firewall rules, bypass network filtering, or cause denial-of-service conditions. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in Linux Kernel version v5.11 by commit 767d1216bff82507c945e92fe719dff2083bb2f4 and has been fixed in version v5.18.2 by commit cc7c6e0a8e1d45955b976943dbd4ba98448ceb46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The netfilter nf_tables vulnerability on the netns pre_exit path could potentially lead to security issues, including manipulation of firewall rules, bypassing network filtering, or causing denial-of-service conditions. It is crucial to update the Linux Kernel package to version v5.18.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could include manipulation of firewall rules, bypassing network filtering, or causing denial-of-service conditions. However, the actual impact and attack plausibility have not been proven yet.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel package to the fixed version v5.18.2 or later.
This vulnerability was discovered through automated analysis and identification of potential security vulnerabilities. The actual impact and attack plausibility have not been proven yet.
You can find more information about this vulnerability in the Open Source Vulnerability Database. The vulnerability ID is GSD-2022-1002880.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
