netfilter: nf_tables: unregister flowtable hooks on netns exit
Summary
GSD-2022-1000808: netfilter: nf_tables: unregister flowtable hooks on netns exit. Affects Kernel versions >= ff4bf2f42a40e7dff28379f085b64df322c70b45, < 8ffb8ac3448845f65634889b051bd65e4dee484b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is an essential component of the Linux operating system. It provides the core functionality and interfaces for the system's operation. The nf_tables module within the Kernel package is responsible for managing network packet filtering rules. It allows users to define and manipulate firewall rules for network traffic. However, a vulnerability has been discovered in the nf_tables module that can lead to potential security risks.
Vulnerability Detail
The vulnerability in the nf_tables module occurs when flowtable hooks are not properly unregistered upon network namespace (netns) exit. This can result in a resource leak, potentially allowing an attacker to exploit the system or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.15.26 by commit 8ffb8ac3448845f65634889b051bd65e4dee484b. The vulnerability was introduced in version v5.5 by commit ff4bf2f42a40e7dff28379f085b64df322c70b45.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The nf_tables vulnerability in the Kernel package can lead to potential security risks, including resource leaks and system exploitation. It is crucial to update the Linux Kernel to version v5.15.26 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, it has the potential to lead to resource leaks, system exploitation, or denial-of-service (DoS) conditions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you in real-time if any open-source vulnerabilities, including this one, are found.
Yes, a patch is available in Linux Kernel version v5.15.26. It is recommended to update to this version or later to fix the vulnerability.
No, the recommended approach is to update the Linux Kernel to the fixed version. Manually fixing the vulnerability without updating the Kernel may not provide complete protection.
You can find more information about this vulnerability in the GSD-2022-1000808 entry of the GSD database maintained by the Cloud Security Alliance. The link to the entry is available in the sources section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
