netfilter: nftables: Avoid Overflows in nft_hash_buckets()
Summary
GSD-2021-1000324: netfilter: nftables: avoid overflows in nft_hash_buckets(). Affects Kernel versions >= 0ed6389c483dc77cdbdd48de0ca7ce41723dd667, < 72b49dd116ca00a46a11d5a4d8d7987f05ed9cd7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The netfilter subsystem within the kernel is responsible for packet filtering, network address translation, and port translation. nftables is a framework used by netfilter to manage packet filtering rulesets. The nft_hash_buckets() function is a critical component of nftables that calculates the number of hash buckets based on the specified size. However, a vulnerability exists in this function that can lead to overflows.
Vulnerability Detail
The vulnerability in nft_hash_buckets() arises from a lack of proper input validation. An attacker could exploit this vulnerability by providing a maliciously crafted input that triggers an integer overflow. This overflow can result in memory corruption, leading to a variety of potential consequences such as denial of service, privilege escalation, or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netfilter vulnerability in nftables' nft_hash_buckets() function can lead to serious security risks if left unpatched. It is crucial to update the Linux Kernel to a version that includes the fix to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel that provides the core functionality for various Linux distributions.
Netfilter is a subsystem within the Linux Kernel that provides packet filtering, network address translation, and port translation.
nftables is a framework used by netfilter to manage packet filtering rulesets.
The nft_hash_buckets() function is a critical component of nftables that calculates the number of hash buckets based on the specified size.
The potential consequences of this vulnerability include denial of service, privilege escalation, or arbitrary code execution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
