netfilter: ipset: Fix oversized kvmalloc() calls
Summary
GSD-2021-1001498: netfilter: ipset: Fix oversized kvmalloc() calls. Affects Kernel versions < c55127a19d3cc334978eaddc2d7cdb19e2c2b29f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation. It includes various modules, such as ipset, which allows the creation and management of large sets of IP addresses, networks, and ports. The ipset module is susceptible to a vulnerability related to oversized kvmalloc() calls.
Vulnerability Detail
The vulnerability in the ipset module arises from the usage of oversized kvmalloc() calls. This can lead to memory allocation failures and potential system crashes or other unexpected behavior. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The ipset module in the netfilter package is vulnerable to oversized kvmalloc() calls, which can lead to memory allocation failures and potential system crashes or other unexpected behavior. It is recommended to update the Linux Kernel to version v4.4.286 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation.
The ipset module is a component of the netfilter package that allows the creation and management of large sets of IP addresses, networks, and ports.
The impact of this vulnerability includes potential system crashes, unexpected behavior, denial-of-service (DoS) conditions, and the possibility of arbitrary code execution with elevated privileges.
To fix this vulnerability, update the Linux Kernel to version v4.4.286 or later, which includes the necessary fix for the oversized kvmalloc() calls.
No specific workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
