netfilter: nftables: Fix a memleak from userdata error path in new objects
Summary
GSD-2021-1000327: netfilter: nftables: Fix a memleak from userdata error path in new objects. Affects Kernel versions >= b131c96496b369c7b14125e7c50e89ac7cec8051, < 2c784a500f5edd337258b0fdb2f31bc9abde1a23. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a part of the Linux Kernel ecosystem and is responsible for implementing packet filtering and network address translation (NAT) in the Linux operating system. It provides a framework for filtering and manipulating network packets at various layers of the network stack. The nftables component within netfilter is a subsystem that replaces the older iptables and ip6tables tools for packet filtering. It allows users to define firewall rules and perform network address translation using a more flexible and efficient syntax.
Vulnerability Detail
This vulnerability in nftables is caused by a memory leak in the error path of new objects that contain userdata. When an error occurs during the creation of new objects, such as tables or rules, the userdata associated with these objects is not properly freed, leading to a memory leak. An attacker could potentially exploit this vulnerability by repeatedly triggering the creation of new objects with userdata, causing a gradual depletion of system memory and potentially leading to a denial-of-service condition. The impact of this vulnerability has not been proven, but it is important to address the memory leak to ensure system stability and prevent potential resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have proper monitoring and resource management in place to detect and handle potential memory leaks. Regularly monitoring system memory usage and implementing memory management techniques can help mitigate the impact of this vulnerability.
Conclusion
In conclusion, the netfilter package's nftables component is affected by a memory leak vulnerability in the error path of new objects with userdata. This vulnerability can potentially lead to a gradual depletion of system memory and a denial-of-service condition. To mitigate this risk, it is recommended to update the Linux Kernel to version v5.10.38 or later, which includes the necessary fix. Proper monitoring and resource management techniques can also help mitigate the impact of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a part of the Linux Kernel ecosystem that provides packet filtering and network address translation capabilities. Nftables is a subsystem within netfilter that replaces the older iptables and ip6tables tools for packet filtering and network address translation.
The impact of this vulnerability has not been proven, but it could potentially lead to a gradual depletion of system memory and result in a denial-of-service condition.
To fix this vulnerability, update the Linux Kernel to version v5.10.38 or later, which includes the necessary fix for the memory leak in nftables.
There is no specific workaround mentioned for this vulnerability. However, implementing proper monitoring and resource management techniques can help mitigate the risk.
The updated Linux Kernel can be obtained from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
