netfilter: conntrack: Make global sysctls readonly in non-init netns
Summary
GSD-2021-1000164: netfilter: conntrack: Make global sysctls readonly in non-init netns. Affects Kernel versions >= d0febd81ae77a0e13717f1412ff9589e43fc4f8b, < d3598eb3915cc0c0d8cab42f4a6258ff44c4033e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The netfilter subsystem within the Kernel is responsible for packet filtering, network address translation, and connection tracking. It allows administrators to define rules and policies for network traffic. However, a vulnerability has been discovered in the conntrack module of netfilter, specifically in non-init netns. This vulnerability could potentially be exploited to modify global sysctls in non-init netns, leading to unauthorized access or manipulation of network connections.
Vulnerability Detail
The vulnerability in the netfilter conntrack module allows for the modification of global sysctls in non-init netns. This means that an attacker with access to a non-init network namespace could potentially alter critical system settings related to connection tracking. By manipulating these sysctls, an attacker could gain unauthorized access to network connections, modify connection tracking behavior, or disrupt network functionality. The impact and attack plausibility of this vulnerability have not yet been proven, but it is important to address it to prevent potential security breaches.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.35 or later. This fix was implemented in commit d3598eb3915cc0c0d8cab42f4a6258ff44c4033e. Updating the Kernel will ensure that the global sysctls in non-init netns are made readonly, preventing unauthorized modification. It is crucial to regularly update the Kernel to stay protected against known vulnerabilities.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Linux Kernel to the fixed version.
Conclusion
The netfilter conntrack vulnerability in the Kernel package poses a potential risk to the security and stability of Linux systems. It is crucial to update the Kernel to the fixed version to prevent unauthorized modification of global sysctls in non-init netns. Regularly updating the Kernel is essential for maintaining a secure and reliable system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter conntrack module is a component of the netfilter subsystem in the Linux Kernel. It is responsible for connection tracking, which allows the Kernel to keep track of network connections and their associated states.
Sysctls are kernel parameters that allow for runtime configuration of various aspects of the Linux Kernel. They can control network behavior, file system settings, and many other system parameters.
If an attacker gains access to a non-init network namespace, they could potentially modify the global sysctls related to connection tracking. This could allow them to manipulate network connections, gain unauthorized access, or disrupt network functionality.
There is no evidence or reports of this vulnerability being exploited in the wild. However, it is important to address it promptly to prevent any potential security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it to identify any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.