netfilter: nf_tables: disallow non-stateful expression in sets earlier
Summary
GSD-2022-1002881: netfilter: nf_tables: disallow non-stateful expression in sets earlier. Affects Kernel versions >= 0b2d8a7b638b5034d2d68f6add8af94daaa1d4cd, < 8f44c83e51b4ca49c815f8dd0d9c38f497cdbcb0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for software to interact with the hardware. It is responsible for tasks such as process management, memory management, and device drivers. The vulnerability specifically impacts the nf_tables module, which is a subsystem of the netfilter framework used for packet filtering and network address translation in Linux. The nf_tables module allows users to define sets of IP addresses or ports for filtering purposes.
Vulnerability Detail
The vulnerability in nf_tables allows the use of non-stateful expressions in sets, which can lead to potential security risks. Non-stateful expressions are expressions that do not depend on the state of the network connection. By disallowing non-stateful expressions in sets earlier, the vulnerability is mitigated. The impact and attack plausibility of this vulnerability have not yet been proven. However, it is important to address this issue to ensure the security of the network filtering functionality provided by nf_tables.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in nf_tables that allows the use of non-stateful expressions in sets has been identified. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.18.2 or later. This fix disallows non-stateful expressions in sets earlier, ensuring the security of the network filtering functionality provided by nf_tables. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown as the attack plausibility has not been proven. However, it is important to address this issue to ensure the security of the network filtering functionality provided by nf_tables.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to monitor and alert in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your manifest file like package-lock.json to the playground and it will provide information on any vulnerabilities affecting your software.
Yes, a fix for this vulnerability is available in Linux Kernel version v5.18.2 or later. It is recommended to update the Kernel to mitigate the vulnerability.
There are currently no known exploits for this vulnerability. However, it is important to address the issue by applying the recommended fix to ensure the security of the network filtering functionality provided by nf_tables.
You can find more information about this vulnerability in the GSD-2022-1002881 entry of the GSD Database maintained by the Cloud Security Alliance. The entry provides details on the vulnerability, including its impact, fix, and affected package.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
