netfilter: nft_set_pipapo: release elements in clone from abort path
Summary
GSD-2022-1004208: netfilter: nft_set_pipapo: release elements in clone from abort path. Affects Kernel versions >= 3c4287f62044a90e73a561aa05fc46e62da173da, < d2b18d110685ce46ca1633b8ec586c685e243a51. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides firewall functionality. It allows for the filtering and manipulation of network packets at various layers of the network stack. The nft_set_pipapo module is a specific component within netfilter that handles the creation and management of sets. Sets are data structures used to store and match network addresses, ports, or other attributes. This vulnerability affects the nft_set_pipapo module and its ability to properly release elements during a clone operation.
Vulnerability Detail
The vulnerability arises from a failure to release elements in the clone operation of the nft_set_pipapo module. This can lead to resource leaks and potential memory corruption. An attacker may be able to exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code with elevated privileges. The vulnerability was introduced in version v5.6 of the Linux Kernel and has been fixed in version v5.18.11.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected nft_set_pipapo module if it is not essential for their system's functionality. This can be done by modifying the kernel configuration and rebuilding the kernel without including the module. However, this workaround may impact certain firewall and network filtering capabilities.
Conclusion
The netfilter nft_set_pipapo vulnerability can be mitigated by updating the Linux Kernel to version v5.18.11 or later. Users can also consider disabling the affected module if it is not necessary for their system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a component of the Linux Kernel that provides firewall functionality, allowing for the filtering and manipulation of network packets.
nft_set_pipapo is a module within netfilter that handles the creation and management of sets, which are data structures used to store and match network addresses, ports, or other attributes.
The vulnerability can lead to resource leaks and potential memory corruption. An attacker may be able to cause a denial-of-service condition or execute arbitrary code with elevated privileges.
To fix this vulnerability, update the Linux Kernel to version v5.18.11 or later by obtaining the latest stable release from the official Linux Kernel repository and following the installation instructions provided.
Yes, users can disable the affected nft_set_pipapo module if it is not essential for their system's functionality. This can be done by modifying the kernel configuration and rebuilding the kernel without including the module.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
