netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
Summary
GSD-2021-1002819: netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy(). Affects Kernel versions >= aaa31047a6d25da0fa101da1ed544e1247949b40, < 9d558e5f0d6fdd0a568f73dceb0b40c4f5012e5a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for applications to interact with hardware. It includes various subsystems, such as netfilter, which is responsible for packet filtering and network address translation. The nf_tables component within netfilter allows users to define firewall rules and perform network packet classification.
The vulnerability in nf_tables arises from a use-after-free bug in the nft_set_catchall_destroy() function. This function is responsible for freeing resources associated with a catch-all set, which is a special set that matches packets that do not match any other sets. Exploiting this vulnerability could lead to a use-after-free condition, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
Vulnerability Detail
The use-after-free vulnerability in nft_set_catchall_destroy() is caused by improper handling of catch-all sets in nf_tables. When a catch-all set is destroyed, the function fails to properly release the associated resources, leading to a use-after-free condition. An attacker could potentially exploit this vulnerability by triggering the destruction of a catch-all set and then manipulating the freed memory to execute arbitrary code or disrupt the normal operation of the system.
The vulnerability was introduced in Linux Kernel version v5.13 by commit aaa31047a6d25da0fa101da1ed544e1247949b40 and is fixed in version v5.15.12 by commit 9d558e5f0d6fdd0a568f73dceb0b40c4f5012e5a.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The use-after-free vulnerability in nf_tables can be mitigated by updating the Linux Kernel package to version v5.15.12 or later. This will ensure that the fix for the vulnerability is applied and reduce the risk of exploitation. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition on a system running the affected version of the Linux Kernel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the Linux Kernel package to the fixed version.
There is no information available regarding exploitation of this vulnerability in the wild at the time of this report.
You can find more information about this vulnerability in the GSD-2021-1002819 JSON report available on the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002819.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
