netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Summary
GSD-2021-1002096: netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value. Affects Kernel versions >= 68983a354a655c35d3fb204489d383a2a051fda7, < cae7cab804c943d723d52724a3aeb07a3f4a2650. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides firewall functionality. It allows for the filtering and manipulation of network packets, enabling the implementation of various network security features. One of the modules within netfilter is xt_IDLETIMER, which is responsible for tracking idle connections and applying specific actions based on predefined timers. However, a vulnerability has been discovered in xt_IDLETIMER that can lead to a panic when the timer_type parameter contains a garbage value.
Vulnerability Detail
The vulnerability in xt_IDLETIMER arises when an invalid or unexpected value is provided for the timer_type parameter. This can occur due to improper input validation or manipulation. When a garbage value is encountered, it triggers a panic in the system, resulting in a crash or instability. The impact of this vulnerability can range from denial of service to potential privilege escalation if an attacker can exploit the panic to gain elevated privileges. The vulnerability was introduced in Linux Kernel version v5.7 and has been fixed in version v5.14.15.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the xt_IDLETIMER module if it is not essential for their system's functionality. This can be achieved by removing or commenting out the corresponding entry in the kernel configuration file and rebuilding the kernel. However, this workaround should only be considered temporary, as it may limit certain firewall capabilities.
Conclusion
The netfilter package in the Linux Kernel is vulnerable to a panic-inducing issue in the xt_IDLETIMER module. This vulnerability can result in system crashes, denial of service, or potential privilege escalation. It is crucial to update the Linux Kernel to version v5.14.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Netfilter is a component of the Linux Kernel that provides firewall functionality, allowing for the filtering and manipulation of network packets.
xt_IDLETIMER is a module within netfilter that tracks idle connections and applies actions based on predefined timers.
The vulnerability occurs when an invalid or unexpected value is provided for the timer_type parameter, triggering a panic in the system.
The vulnerability can lead to system crashes, denial of service, or potential privilege escalation if exploited by an attacker.
To fix the vulnerability, update the Linux Kernel to version v5.14.15 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
