netfilter: nf_tables: Memory Leak in Flow Rule Commit Path
Summary
GSD-2022-1002958: netfilter: nf_tables: memleak flow rule from commit path. Affects Kernel versions >= c9626a2cbdb20e26587b3fad99960520a023432b, < 80de9ea1f5b808a6601e91111fae601df2b26369. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the essential services for all other parts of the operating system, handling tasks such as memory management, process scheduling, and device drivers. The netfilter framework within the kernel allows for the implementation of various network packet filtering functionalities, including firewalling, network address translation (NAT), and packet mangling.
The nf_tables subsystem is a component of netfilter that provides a new packet classification framework. It allows users to define and manage firewall rules and network traffic flow control.
This vulnerability affects the nf_tables subsystem in the Linux Kernel.
Vulnerability Detail
The vulnerability identified as GSD-2022-1002958 is a memory leak issue in the flow rule commit path of the nf_tables subsystem. When committing a flow rule, a memory leak occurs, leading to the consumption of system resources. An attacker could potentially exploit this vulnerability to exhaust system memory, causing a denial-of-service condition.
The vulnerability was introduced in Linux Kernel version 5.3 by commit c9626a2cbdb20e26587b3fad99960520a023432b and is fixed in version 5.17.15 by commit 80de9ea1f5b808a6601e91111fae601df2b26369.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The memory leak vulnerability in the nf_tables subsystem of the Linux Kernel can be exploited to exhaust system memory, resulting in a denial-of-service condition. It is crucial to update the Linux Kernel to version 5.17.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can be exploited by an attacker to exhaust system memory, leading to a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a patch is available in Linux Kernel version 5.17.15. It is recommended to update to this version or later.
No, this vulnerability requires local access to the system to be exploited.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
