netfilter: nf_tables: hold mutex on netns pre_exit path
Summary
GSD-2022-1003189: netfilter: nf_tables: hold mutex on netns pre_exit path. Affects Kernel versions >= 767d1216bff82507c945e92fe719dff2083bb2f4, < f2a489faa5c67836a0a051644c86b1f1346f0f02. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system. It provides the core functionality and acts as a bridge between the hardware and software layers. The netfilter subsystem within the Kernel is responsible for packet filtering, network address translation, and other network-related operations. One of its components, nf_tables, is a framework for packet classification and manipulation. It allows users to define firewall rules and perform various network-related tasks. However, a vulnerability has been discovered in nf_tables that could potentially lead to security breaches and unauthorized access.
Vulnerability Detail
The vulnerability in nf_tables arises from a failure to hold a mutex on the netns pre_exit path. This can result in a race condition where a network namespace is destroyed while still being accessed by nf_tables. An attacker could exploit this vulnerability to gain unauthorized access to the system or cause a denial of service by crashing the kernel. The impact and attack plausibility of this vulnerability have not yet been proven, but it is crucial to address it to ensure the security and stability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the nf_tables module if it is not required for their specific use case. This can be achieved by executing the following command as root:
modprobe -r nf_tables
Conclusion
The vulnerability in nf_tables poses a potential security risk to Linux systems. It is recommended to update the Kernel to version v5.17.13 or later to address this issue. Users can also disable the nf_tables module as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to unauthorized access to the system or a denial of service by crashing the kernel.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply provide the manifest file (e.g., package-lock.json) of your application, and Vulert will analyze it in real-time.
Yes, users can disable the nf_tables module if it is not required for their specific use case. Please refer to the 'workaround' section for detailed instructions.
At the time of this report, no known exploits for this vulnerability have been reported. However, it is crucial to address the issue promptly to mitigate any potential risks.
For more information about this vulnerability, including technical details and the fix, please refer to the official Linux Kernel repository and the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
