netfilter: Use get_random_u32 instead of prandom
Summary
GSD-2022-1004635: netfilter: use get_random_u32 instead of prandom. Affects Kernel versions >= 6b2faee0ca91b63bd5a3b2087d4f25c76b983961, < 15cc30ac2a8d7185f8ebf97dd1ddd90a7c79783b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides network packet filtering functionality. It allows users to define rules for filtering and manipulating network traffic. The package includes various modules, such as iptables and ip6tables, which implement the filtering rules. This vulnerability affects the netfilter package in the Linux Kernel.
Vulnerability Detail
The vulnerability in the netfilter package arises from the use of the prandom function instead of the more secure get_random_u32 function. The prandom function generates pseudo-random numbers, which may not provide sufficient entropy for security-sensitive operations. An attacker could potentially predict the generated numbers and exploit this weakness to bypass or manipulate network packet filtering rules. The impact of this vulnerability could range from unauthorized access to network resources to denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Linux Kernel.
Conclusion
The netfilter package in the Linux Kernel is vulnerable to a weakness in the usage of the prandom function. This vulnerability can be mitigated by updating the Linux Kernel to version v5.10.127 or later. It is recommended to apply the fix promptly to ensure the security of network packet filtering functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a component of the Linux Kernel that provides network packet filtering functionality. It allows users to define rules for filtering and manipulating network traffic.
The vulnerability could allow an attacker to bypass or manipulate network packet filtering rules, potentially leading to unauthorized access or denial of service attacks.
To fix this vulnerability, update the Linux Kernel to version v5.10.127 or later, which includes the necessary fix.
No known workarounds are available for this vulnerability. It is crucial to apply the recommended fix by updating the Linux Kernel.
Users can obtain the updated Linux Kernel from the official Linux Kernel repository.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
