netfilter: ipset: Fix oversized kvmalloc() calls
Summary
GSD-2021-1001639: netfilter: ipset: Fix oversized kvmalloc() calls. Affects Kernel versions < da5b8b9319f044c2ca24f6602c54033931e0c1cc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation. It includes various modules, one of which is ipset. The ipset module allows administrators to create, manage, and store sets of IP addresses, networks, and ports, which can be used for efficient packet matching. However, a vulnerability has been discovered in the ipset module that involves oversized kvmalloc() calls.
Vulnerability Detail
The vulnerability in the ipset module arises from the usage of oversized kvmalloc() calls. This can lead to memory allocation failures and potential memory corruption issues. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with kernel privileges. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
The vulnerability has been addressed in the Linux Kernel version v5.10.71 by commit da5b8b9319f044c2ca24f6602c54033931e0c1cc. To fix the vulnerability, it is recommended to update the Linux Kernel to this version or a later version that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The netfilter ipset module is vulnerable to oversized kvmalloc() calls, which can result in memory allocation failures and potential memory corruption. It is crucial to update the Linux Kernel to version v5.10.71 or a later version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter package is a part of the Linux Kernel ecosystem and provides a framework for packet filtering and network address translation.
The ipset module is a component of the netfilter package that allows administrators to create, manage, and store sets of IP addresses, networks, and ports.
The impact of this vulnerability is not yet proven, but it could potentially lead to denial-of-service (DoS) conditions or arbitrary code execution with kernel privileges.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.71 or a later version that includes the fix.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.