netfilter: ipset: Fix oversized kvmalloc() calls
Summary
GSD-2021-1001529: netfilter: ipset: Fix oversized kvmalloc() calls. Affects Kernel versions < 633bd6d69eac5deffbaeab4b33b34c7a98a7fc2c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation. It allows administrators to define rules and policies to control network traffic. The ipset component within netfilter is used to manage sets of IP addresses, networks, and ports, providing efficient matching and storage capabilities. However, a vulnerability has been discovered in ipset that involves oversized kvmalloc() calls.
Vulnerability Detail
The vulnerability in ipset arises from the use of oversized kvmalloc() calls. This can lead to memory allocation failures and potential memory corruption issues. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The netfilter ipset vulnerability involving oversized kvmalloc() calls can potentially lead to memory corruption and security risks. It is crucial to update the Linux Kernel to the fixed version v4.14.249 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a packet filtering framework in the Linux Kernel that allows administrators to define rules and policies for network traffic. Ipset is a component of netfilter that provides efficient matching and storage capabilities for sets of IP addresses, networks, and ports.
The impact of this vulnerability is not yet proven. However, it could potentially lead to memory allocation failures and memory corruption issues. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.249 or later. This can be done by fetching the latest stable Linux Kernel source code from the official repository and applying the necessary patches.
No specific workaround has been mentioned for this vulnerability. It is advised to update the Linux Kernel to the fixed version.
More information about this vulnerability can be found in the GitHub repository of the Cloud Security Alliance's GSD Database. The vulnerability ID is GSD-2021-1001529.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
