netfilter: ipset: Fix oversized kvmalloc() calls
Summary
GSD-2021-1001587: netfilter: ipset: Fix oversized kvmalloc() calls. Affects Kernel versions < 6f2f68640b8478b3bd385bc541ee517d7bdddf76. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides network packet filtering functionality. It allows administrators to define rules for accepting, dropping, or modifying network packets based on various criteria. The ipset module within netfilter enables the creation and management of IP sets, which are data structures used for efficient matching of IP addresses. These sets can be used in conjunction with firewall rules to improve performance and simplify configuration. However, a vulnerability has been identified in the ipset module that involves oversized kvmalloc() calls.
Vulnerability Detail
The vulnerability in the ipset module arises from the use of oversized kvmalloc() calls. This can lead to memory allocation failures and potential security issues. An attacker may be able to exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. Users are advised to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The netfilter ipset module vulnerability involving oversized kvmalloc() calls can potentially lead to memory allocation failures and security issues. It is crucial for users to update their Linux Kernel to the fixed version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a component of the Linux Kernel that provides network packet filtering functionality. The ipset module within netfilter enables the creation and management of IP sets, which are data structures used for efficient matching of IP addresses.
The impact of this vulnerability is not yet proven. However, it could potentially lead to denial-of-service (DoS) conditions or arbitrary code execution with elevated privileges.
To fix this vulnerability, users should update their Linux Kernel to version v5.4.151 or later, which includes the necessary fix.
No specific workarounds have been provided for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel.
For more information about this vulnerability, you can refer to the provided references link in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
