netfilter: nf_tables: Memory Leak in Flow Rule Commit Path
Summary
GSD-2022-1003262: netfilter: nf_tables: memleak flow rule from commit path. Affects Kernel versions >= c9626a2cbdb20e26587b3fad99960520a023432b, < e33d9bd563e71f6c6528b96008d65524a459c4dc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The netfilter subsystem within the kernel is responsible for packet filtering, network address translation (NAT), and other network-related operations. nf_tables is a component of netfilter that provides a new packet classification framework. It allows users to define rules for packet filtering and manipulation. However, a vulnerability has been discovered in nf_tables that leads to a memory leak when committing flow rules.
Vulnerability Detail
The vulnerability in nf_tables arises from a memory leak in the flow rule commit path. When flow rules are committed, memory resources are not properly freed, resulting in a continuous accumulation of memory over time. This can lead to memory exhaustion and potential denial-of-service (DoS) conditions. The vulnerability was introduced in Linux Kernel version 5.3 and is fixed in version 5.15.47 by commit e33d9bd563e71f6c6528b96008d65524a459c4dc.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, users should update their Linux Kernel to version 5.15.47 or later. This can be done by downloading the latest kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions. Alternatively, users can wait for their Linux distribution to release an updated kernel package and install it through the package manager.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can unload the nf_tables module to prevent the vulnerability from being exploited. This can be done by running the following command as root:
rmmod nf_tables
Conclusion
The nf_tables memory leak vulnerability in the Linux Kernel can lead to memory exhaustion and potential denial-of-service conditions. It is crucial for users to update their kernel to version 5.15.47 or later to mitigate this vulnerability. Alternatively, users can unload the nf_tables module as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nf_tables is a component of the netfilter subsystem in the Linux Kernel. It provides a new packet classification framework for packet filtering and manipulation.
The vulnerability can lead to memory exhaustion and potential denial-of-service (DoS) conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities.
Yes, the vulnerability is fixed in Linux Kernel version 5.15.47. Users should update their kernel to this version or later.
Yes, as a temporary workaround, you can unload the nf_tables module by running the command 'rmmod nf_tables' as root.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.