netfilter: nf_tables: Memory Leak in Flow Rule Commit Path
Summary
GSD-2022-1002609: netfilter: nf_tables: memleak flow rule from commit path. Affects Kernel versions >= c9626a2cbdb20e26587b3fad99960520a023432b, < ab9f34a30c23f656e76f4c5b83125a4e7b53c86e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the essential services to enable the execution of programs on the hardware. The netfilter subsystem within the Linux Kernel is responsible for packet filtering, network address translation (NAT), and other network-related operations. nf_tables is a component of netfilter that provides a new packet classification framework. This vulnerability affects the nf_tables component of the Linux Kernel.
Vulnerability Detail
The vulnerability in nf_tables arises from a memory leak in the flow rule commit path. This flaw was introduced in version v5.3 of the Linux Kernel by commit c9626a2cbdb20e26587b3fad99960520a023432b and was fixed in version v5.18.4 by commit ab9f34a30c23f656e76f4c5b83125a4e7b53c86e. The memory leak occurs when committing a flow rule, leading to the gradual depletion of system memory. While the impact and attack plausibility have not been proven, this vulnerability has the potential to cause system instability and denial-of-service conditions.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.18.4 or later. This can be done by pulling the latest changes from the official Linux Kernel repository using the following command:
$ git pull https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
After updating the kernel, recompile and reinstall it on the affected system. Ensure that the new kernel version is properly tested before deploying it in a production environment.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can mitigate the memory leak by avoiding the use of flow rules in nf_tables. Instead, they can rely on other packet classification mechanisms available in the Linux Kernel. However, this workaround may limit the functionality and flexibility provided by nf_tables.
Conclusion
The memory leak vulnerability in nf_tables can lead to system instability and denial-of-service conditions. It is crucial to update the Linux Kernel to version v5.18.4 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nf_tables is a component of the netfilter subsystem in the Linux Kernel that provides a new packet classification framework. It allows users to define rules for packet filtering, network address translation (NAT), and other network-related operations.
The impact of this vulnerability is not yet proven, but it has the potential to cause system instability and denial-of-service conditions due to memory depletion.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in Linux Kernel version v5.18.4. It is recommended to update the kernel to this version or later to mitigate the risk.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to prevent any potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.