netfilter: nftables: Avoid Overflows in nft_hash_buckets()
Summary
GSD-2021-1000447: netfilter: nftables: avoid overflows in nft_hash_buckets(). Affects Kernel versions >= 0ed6389c483dc77cdbdd48de0ca7ce41723dd667, < efcd730ddd6f25578bd31bfe703e593e2421d708. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation. It includes various components such as iptables, ip6tables, and nftables. nftables is a subsystem within netfilter that allows users to define firewall rules and perform packet manipulation. It uses hash tables for efficient lookup and matching of packets based on specific criteria.
Vulnerability Detail
The vulnerability identified as GSD-2021-1000447 affects the nftables component of the netfilter package. It involves potential overflows in the nft_hash_buckets() function. These overflows can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v4.9 of the Linux Kernel and fixed in version v4.19.191.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider disabling or restricting the usage of nftables until the Kernel is updated to a fixed version. This can be achieved by modifying the system configuration to prevent the loading of nftables modules or by using alternative firewall solutions available in the Linux ecosystem.
Conclusion
The netfilter vulnerability identified as GSD-2021-1000447 in the nftables component can lead to memory corruption and potential code execution or denial-of-service. It is crucial to update the Linux Kernel to version v4.19.191 or later to mitigate this vulnerability. Alternatively, users can employ workarounds such as disabling or restricting the usage of nftables. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a packet filtering framework in the Linux Kernel that provides firewall and network address translation capabilities. nftables is a subsystem within netfilter that allows users to define firewall rules and perform packet manipulation.
The vulnerability can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
The vulnerability was introduced in version v4.9 of the Linux Kernel.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.191 or later.
Yes, users can consider disabling or restricting the usage of nftables until the Kernel is updated to a fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
