netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version
Summary
GSD-2021-1000565: netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version. Affects Kernel versions >= 7400b063969bdca4a06cd97f1294d765c8eecbe1, < 727a2b4fc951ee69847d4904d98961856ea9fbe6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a part of the Linux Kernel ecosystem. It provides a framework for packet filtering and network address translation. The nft_set_pipapo_avx2 component is responsible for handling AVX2 instructions in the netfilter set implementation. AVX2 is an extension to the x86 instruction set architecture that enhances performance for certain operations. This vulnerability affects the AVX2 version of nft_set_pipapo, which fails to check if the FPU (Floating Point Unit) is usable before executing AVX2 instructions.
Vulnerability Detail
The vulnerability in nft_set_pipapo_avx2 arises from the lack of a proper check for the usability of the FPU. This can lead to a system crash or other unexpected behavior if AVX2 instructions are executed without a functional FPU. An attacker may be able to exploit this vulnerability to cause a denial of service or potentially execute arbitrary code. The vulnerability was introduced in version v5.7 of the Linux Kernel and has been fixed in version v5.12.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a workaround for this vulnerability is to disable the use of AVX2 instructions in the nft_set_pipapo component. This can be achieved by modifying the code to use the non-AVX2 version of nft_set_pipapo. Here is an example of the modified code:
// Original code
nft_set_pipapo_avx2()
{
// AVX2 instructions
}
// Modified code
nft_set_pipapo()
{
// Non-AVX2 instructions
}
Conclusion
The netfilter package in the Linux Kernel is vulnerable to a flaw in the nft_set_pipapo_avx2 component, which fails to check the usability of the FPU before executing AVX2 instructions. This vulnerability can result in a system crash or other unexpected behavior. It is recommended to update the Linux Kernel to version v5.12.9 or later to fix this vulnerability. Alternatively, a workaround is available by modifying the code to use the non-AVX2 version of nft_set_pipapo. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter package is a component of the Linux Kernel that provides packet filtering and network address translation capabilities.
AVX2 is an extension to the x86 instruction set architecture that enhances performance for certain operations.
This vulnerability can lead to a system crash or other unexpected behavior if AVX2 instructions are executed without a functional FPU. An attacker may be able to exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
To fix this vulnerability, update the Linux Kernel to version v5.12.9 or later, which includes the necessary fix commit.
Yes, a workaround is to disable the use of AVX2 instructions in the nft_set_pipapo component by modifying the code to use the non-AVX2 version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
