netfilter: nft_limit: Divide Error Vulnerability in Kernel
Summary
UVI-2021-1000028: netfilter: nft_limit: avoid possible divide error in nft_limit_init. Affects Kernel versions >= c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, < 1bb3ee4259936cc3b2d80a4a480bbb4868575071. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as a bridge between hardware and software. It manages system resources, facilitates communication between processes, and ensures security and stability. The netfilter module within the Kernel is responsible for packet filtering and network address translation. It includes various components, such as nft_limit, which allows users to set limits on network traffic. However, a vulnerability has been discovered in the nft_limit component that can lead to a divide error.
Vulnerability Detail
The netfilter nft_limit vulnerability arises from a possible divide error in the nft_limit_init function. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. The divide error occurs when the divisor is zero, resulting in an exception. An attacker can trigger this vulnerability by sending specially crafted network traffic that triggers the nft_limit component. Successful exploitation of this vulnerability could lead to system crashes, resource exhaustion, or unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the nft_limit module or remove any rules that utilize it. This can be achieved by modifying the firewall configuration or using the appropriate command-line tools. However, it is strongly recommended to apply the official fix by updating the Kernel to ensure comprehensive protection against this vulnerability.
Conclusion
The netfilter nft_limit vulnerability in the Linux Kernel poses a significant risk to affected systems. It is crucial to promptly update the Kernel to version v5.11.16 or later to mitigate this vulnerability. Disabling the nft_limit module or removing associated rules can serve as a temporary workaround, but it is strongly recommended to apply the official fix. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter nft_limit vulnerability is a security flaw in the Linux Kernel's netfilter module. It arises from a possible divide error in the nft_limit_init function, which can be exploited to cause a denial-of-service condition or execute arbitrary code with kernel privileges.
Successful exploitation of this vulnerability can lead to system crashes, resource exhaustion, or unauthorized access to sensitive information. It poses a significant risk to the security and stability of affected systems.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.11.16 or later. The fix for this vulnerability was implemented in commit 1bb3ee4259936cc3b2d80a4a480bbb4868575071. Users can obtain the updated Kernel from the official Linux Kernel repository.
As a temporary workaround, users can disable the nft_limit module or remove any rules that utilize it. However, it is strongly advised to apply the official fix by updating the Kernel to ensure comprehensive protection against this vulnerability.
For more information about this vulnerability, including technical details and the fix implementation, you can refer to the vulnerability report in the Cloud Security Alliance's GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000028.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
