netfilter: nft_ct: skip expectations for confirmed conntrack in Kernel
Summary
GSD-2021-1000746: netfilter: nft_ct: skip expectations for confirmed conntrack. Affects Kernel versions >= 857b46027d6f91150797295752581b7155b9d0e1, < da8d31e80ff425f5a65dab7060d5c4aba749e562. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and manages system resources. It includes various subsystems and modules, such as netfilter, which is responsible for packet filtering and network address translation. The netfilter module includes nft_ct, which handles expectations for confirmed conntrack. Conntrack is a mechanism that tracks network connections and their states. This vulnerability in nft_ct allows expectations for confirmed conntrack to be skipped, potentially leading to security issues.
Vulnerability Detail
The vulnerability in netfilter's nft_ct module allows expectations for confirmed conntrack to be bypassed. This means that certain network connections may not be properly tracked and validated, potentially leading to unauthorized access or other security breaches. The vulnerability was introduced in Linux Kernel version v5.3 by commit 857b46027d6f91150797295752581b7155b9d0e1 and is fixed in version v5.4.125 by commit da8d31e80ff425f5a65dab7060d5c4aba749e562.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.125 or later. This can be done by downloading the latest stable version from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and following the installation instructions provided. It is important to ensure that the updated Kernel is compatible with the specific Linux distribution being used.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The netfilter vulnerability in the nft_ct module can potentially lead to security issues by allowing expectations for confirmed conntrack to be skipped. It is crucial to update the Linux Kernel to version v5.4.125 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a subsystem in the Linux Kernel that provides packet filtering and network address translation. nft_ct is a module within netfilter that handles expectations for confirmed conntrack.
Conntrack is a mechanism in the Linux Kernel that tracks network connections and their states. It is used for various network-related operations, such as firewalling and NAT.
This vulnerability allows expectations for confirmed conntrack to be skipped, potentially leading to security issues. It may allow unauthorized access or other network-based attacks.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Yes, the vulnerability is fixed in Linux Kernel version v5.4.125 or later. It is recommended to update the Kernel to the latest stable version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.