Vulnerability in Linux Kernel: net: sched: flower: protect fl_walk() with rcu
Summary
GSD-2021-1001593: net: sched: flower: protect fl_walk() with rcu. Affects Kernel versions >= d39d714969cda5cbda291402c8c6b1fb1047f42e, < 694b0cee7f8546b69a80996a29cb3cf4149c0453. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux Kernel is a critical component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It includes various subsystems, such as networking, memory management, and process scheduling. One of these subsystems is the network scheduler (net_sched), which handles packet scheduling and traffic control. Within net_sched, the flower module provides support for flow-based packet classification and filtering.
The vulnerability identified in the Linux Kernel affects the flower module's fl_walk() function, which is responsible for traversing the flow rules stored in a hash table. Without proper protection, concurrent access to the hash table can lead to race conditions and potential security vulnerabilities.
Vulnerability Detail
The vulnerability in the Linux Kernel's flower module arises from a lack of proper protection in the fl_walk() function. This function is not guarded by RCU (Read-Copy-Update), a mechanism that ensures safe concurrent access to shared data structures. As a result, multiple threads or processes accessing the flow rules hash table simultaneously can lead to race conditions, potentially allowing unauthorized access or modification of flow rules.
The impact of this vulnerability depends on the specific use case and system configuration. However, it could potentially be exploited to bypass network traffic filters, disrupt network communication, or gain unauthorized access to sensitive information.
The vulnerability was introduced in Linux Kernel version 5.3 by commit d39d714969cda5cbda291402c8c6b1fb1047f42e and was fixed in version 5.4.151 by commit 694b0cee7f8546b69a80996a29cb3cf4149c0453.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Linux Kernel's flower module, specifically in the fl_walk() function, can lead to race conditions and potential security vulnerabilities. It is crucial to update the Linux Kernel to version 5.4.151 or later to ensure the vulnerability is fixed. Regularly updating the kernel helps maintain the security and stability of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability depends on the specific use case and system configuration. However, it could potentially be exploited to bypass network traffic filters, disrupt network communication, or gain unauthorized access to sensitive information.
You can check if your system is affected by this vulnerability by verifying the installed version of the Linux Kernel. If your system is running a version prior to 5.4.151, it is vulnerable. Additionally, you can use vulnerability monitoring tools like Vulert (https://vulert.com) to scan your system and identify any potential vulnerabilities.
No specific workarounds have been identified for this vulnerability. It is recommended to update the Linux Kernel to the fixed version (5.4.151 or later) to mitigate the risk.
The vulnerability itself does not provide remote code execution capabilities. However, if an attacker gains access to the affected system, they may be able to exploit the vulnerability to bypass network traffic filters or gain unauthorized access to sensitive information.
At the time of this report, there is no evidence of active exploits targeting this vulnerability. However, it is crucial to apply the recommended fix and keep the Linux Kernel up to date to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
