netfilter: synproxy: Fix out of bounds when parsing TCP options
Summary
GSD-2021-1000981: netfilter: synproxy: Fix out of bounds when parsing TCP options. Affects Kernel versions >= 48b1de4c110a7afa4b85862f6c75af817db26fad, < 9cdf299ba4e153b5e56187648420de22c6216f02. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for applications to interact with the hardware. The netfilter module in the Kernel provides network packet filtering and manipulation capabilities. The synproxy module within netfilter is responsible for handling TCP connections and performing proxy operations. This vulnerability arises from a flaw in the parsing of TCP options, which can lead to an out-of-bounds access issue.
Vulnerability Detail
The vulnerability in the netfilter synproxy module occurs when parsing TCP options. An attacker can exploit this flaw to trigger an out-of-bounds access, potentially leading to memory corruption or disclosure of sensitive information. The impact and attack plausibility have not been proven yet. The vulnerability was introduced in version v3.12 of the Linux Kernel and is fixed in version v5.10.46. The fix can be found in commit 9cdf299ba4e153b5e56187648420de22c6216f02.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The netfilter synproxy vulnerability in the Linux Kernel can be mitigated by updating to version v5.10.46 or later. It is crucial to promptly apply the fix to prevent potential memory corruption or disclosure of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter module in the Linux Kernel provides network packet filtering and manipulation capabilities. It allows administrators to define rules for handling network traffic, such as blocking or forwarding packets based on various criteria.
The synproxy module within netfilter is responsible for handling TCP connections and performing proxy operations. It helps protect against SYN flood attacks by validating and proxying TCP connection requests.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to memory corruption or disclosure of sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
