netfilter: nftables: Avoid Overflows in nft_hash_buckets()
Summary
GSD-2021-1000467: netfilter: nftables: avoid overflows in nft_hash_buckets(). Affects Kernel versions >= 0ed6389c483dc77cdbdd48de0ca7ce41723dd667, < 2824cafc6a93792d9ad85939c499161214d84c4b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The netfilter subsystem within the Kernel is responsible for packet filtering, network address translation, and other network-related operations. nftables is a framework built on top of netfilter that allows users to define and manage firewall rules. The nft_hash_buckets() function is a part of nftables and is used to allocate memory for hash buckets. However, a vulnerability in this function can lead to overflows, potentially resulting in security breaches or system instability.
Vulnerability Detail
The vulnerability in nft_hash_buckets() arises from a lack of proper bounds checking during memory allocation. An attacker could exploit this vulnerability by crafting malicious input that triggers an overflow, leading to memory corruption or other undefined behavior. The impact of this vulnerability could range from denial of service (system crashes) to potential remote code execution. The vulnerability was introduced in version v4.9 of the Linux Kernel and was fixed in version v4.14.233.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by removing or disabling the nftables module. However, this may impact the system's firewall capabilities and is not a recommended long-term solution. To disable the module, execute the following command as root: modprobe -r nftables
Conclusion
The netfilter nftables vulnerability in the Kernel package can lead to overflows in the nft_hash_buckets() function, potentially resulting in security breaches or system instability. It is recommended to update the Kernel to version v4.14.233 or later to mitigate this vulnerability. Users can also use the Vulert Playground (https://vulert.com/scanner) to check if their system is affected and receive real-time alerts for open-source vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from denial of service (system crashes) to potential remote code execution. It is crucial to update the Kernel to the fixed version to mitigate these risks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, a temporary workaround is to disable the nftables module. However, this may impact the system's firewall capabilities and is not a recommended long-term solution. It is advised to update the Kernel to the fixed version as soon as possible.
Yes, this vulnerability has the potential for remote exploitation. An attacker could craft malicious input to trigger the overflow and potentially execute arbitrary code on the affected system.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the fix to prevent any potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
