Refcount Leak in xfrm_policy_check() in Linux Kernel
Summary
GSD-2022-1005952: xfrm: fix refcount leak in __xfrm_policy_check(). Affects Kernel versions >= 134b0fc544ba062498451611cb6f3e4454221b3d, < 63da7a2bbf3f28094920e0b8a17d2571a9bd842d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential services. It is an open-source project that has undergone continuous development and improvement over the years. The xfrm subsystem in the Linux Kernel handles IPsec (Internet Protocol Security) policies and transformations. IPsec is a protocol suite used to secure network communications by encrypting and authenticating IP packets. The xfrm_policy_check() function is a critical part of the xfrm subsystem, responsible for checking and enforcing IPsec policies. However, a vulnerability has been discovered in this function that can lead to a refcount leak.
Vulnerability Detail
The vulnerability in the xfrm_policy_check() function can result in a refcount leak. When a policy is checked, the function increments the reference count of the policy. However, if an error occurs during the policy check, the reference count is not properly decremented, leading to a refcount leak. This can result in resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could exploit this vulnerability by sending specially crafted IP packets that trigger policy check failures, causing the refcount leak and exhausting system resources. The vulnerability was introduced in version v2.6.19 of the Linux Kernel and has been fixed in version v5.4.212.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply patches or backports provided by their Linux distribution or vendor. These patches typically address the specific vulnerability and can be applied without updating the entire Kernel. Users should consult the official documentation or support channels of their Linux distribution or vendor for guidance on applying patches or backports.
Conclusion
The refcount leak vulnerability in the xfrm_policy_check() function of the Linux Kernel can lead to resource exhaustion and potential denial-of-service attacks. It is crucial to update the Kernel to the fixed version or apply patches/backports provided by the Linux distribution or vendor. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your system. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a refcount leak, resulting in resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could exploit this vulnerability to exhaust system resources, causing disruption or unavailability of services.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can also use the Vulert playground (https://vulert.com/scanner) without signing up to check if your application is affected.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches and updates promptly to mitigate potential risks.
The primary solution is to update the Linux Kernel to the fixed version. However, if updating the Kernel is not feasible or practical, users can consider implementing network-level mitigations, such as firewall rules or intrusion prevention systems, to detect and block malicious IP packets that could trigger the vulnerability.
You can refer to the official Linux Kernel documentation, security advisories, and the CVE (Common Vulnerabilities and Exposures) database for more information about this vulnerability. Additionally, you can reach out to the Linux Kernel community and support channels for further assistance.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
