netfilter: nf_tables: Memory Leak in Flow Rule Commit Path
Summary
GSD-2022-1003719: netfilter: nf_tables: memleak flow rule from commit path. Affects Kernel versions >= c9626a2cbdb20e26587b3fad99960520a023432b, < 5b8d63489c3b701eb2a76f848ec94d8cbc9373b9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system that serves as the foundation for various Linux distributions. It provides essential functionality and manages system resources. The netfilter subsystem within the Kernel is responsible for packet filtering, network address translation, and other network-related operations. nf_tables is a component of netfilter that allows users to define and manage firewall rules. This vulnerability affects the nf_tables module in the Linux Kernel.
Vulnerability Detail
The vulnerability identified as GSD-2022-1003719 is a memory leak issue in the flow rule commit path of nf_tables. When committing a flow rule, a memory leak occurs, leading to the consumption of system resources. Although the impact and attack plausibility have not been proven, this vulnerability has the potential to degrade system performance and stability over time. The vulnerability was introduced in Linux Kernel version 5.3 by commit c9626a2cbdb20e26587b3fad99960520a023432b and has been fixed in version 5.4.198 by commit 5b8d63489c3b701eb2a76f848ec94d8cbc9373b9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can unload and reload the nf_tables module to release the consumed memory. This can be achieved by executing the following commands as root:
# rmmod nf_tables
# modprobe nf_tables
Conclusion
In conclusion, the netfilter nf_tables module in the Linux Kernel is affected by a memory leak vulnerability in the flow rule commit path. This vulnerability can lead to resource consumption and potential system performance degradation. It is recommended to update the Kernel to version 5.4.198 or later to mitigate this issue. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
nf_tables is a component of the netfilter subsystem in the Linux Kernel. It provides a framework for defining and managing firewall rules, packet filtering, and network address translation.
The impact of this vulnerability is the gradual consumption of system resources due to a memory leak in the flow rule commit path of nf_tables. This can lead to degraded system performance and stability over time.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
As a temporary workaround, you can unload and reload the nf_tables module to release the consumed memory. This can be done by executing the following commands as root:
# rmmod nf_tables
# modprobe nf_tables
For more information about this vulnerability, you can refer to the vulnerability database entry at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003719.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
