netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version
Summary
GSD-2021-1000610: netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version. Affects Kernel versions >= 7400b063969bdca4a06cd97f1294d765c8eecbe1, < b1f45a26bd322525c14edd9504f6d46dfad679a4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides firewalling and packet filtering capabilities. It is responsible for managing network traffic and enforcing security policies. The nft_set_pipapo_avx2 module is a specific feature within netfilter that utilizes AVX2 instructions for improved performance. However, a vulnerability has been identified in this module that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in nft_set_pipapo_avx2 arises from a missing irq_fpu_usable() check. This check ensures that the Floating Point Unit (FPU) is available and can be used safely. Without this check, the AVX2 instructions may be executed on systems where the FPU is not available, leading to unexpected behavior and potential security risks. The impact of this vulnerability is not yet fully understood, but it could potentially allow attackers to bypass security measures or cause system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider disabling the nft_set_pipapo_avx2 module if it is not essential for their system's functionality. This can be done by modifying the kernel configuration or blacklisting the module.
Conclusion
The netfilter nft_set_pipapo_avx2 vulnerability can be addressed by updating the Linux Kernel to version v5.10.42 or later. This will ensure the necessary irq_fpu_usable() check is in place and provide protection against potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a component of the Linux Kernel that provides firewalling and packet filtering capabilities.
nft_set_pipapo_avx2 is a module within netfilter that utilizes AVX2 instructions for improved performance.
irq_fpu_usable() is a check that ensures the Floating Point Unit (FPU) is available and can be used safely.
The potential risks of this vulnerability include bypassing security measures and causing system instability.
To mitigate this vulnerability, update your Linux Kernel to version v5.10.42 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
