netfilter: nft_limit: Avoid Divide Error in nft_limit_init
Summary
UVI-2021-1000038: netfilter: nft_limit: avoid possible divide error in nft_limit_init. Affects Kernel versions >= c26844eda9d4fdbd266660e3b3de2d0270e3a1ed, < 01fb1626b620cb37a65ad08e0f626489e8f042ef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The netfilter package is a component of the Linux Kernel that provides firewalling and packet filtering capabilities. It is responsible for managing network traffic and enforcing security policies. The nft_limit module within netfilter allows users to set limits on the number of packets that can pass through a network interface. This vulnerability, identified as UVI-2021-1000038, arises from a potential divide error in the nft_limit_init function.
Vulnerability Detail
The vulnerability in nft_limit_init can lead to a divide error. This error occurs when the divisor is zero, resulting in a potential crash or system instability. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability was introduced in version 4.13 of the Linux Kernel and has been fixed in version 5.4.114.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, users can apply a workaround by disabling the nft_limit module. This can be achieved by removing or commenting out the relevant configuration lines in the kernel configuration file and rebuilding the kernel. However, it is strongly advised to update to the latest kernel version as soon as possible.
Conclusion
The netfilter nft_limit vulnerability (UVI-2021-1000038) can be mitigated by updating the Linux Kernel to version 5.4.114 or later. Alternatively, users can disable the nft_limit module as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The netfilter package is a component of the Linux Kernel that provides firewalling and packet filtering capabilities.
The nft_limit module is a part of netfilter that allows users to set limits on the number of packets passing through a network interface.
A divide error occurs when the divisor in a division operation is zero, resulting in an error or system instability.
This vulnerability can lead to a denial-of-service (DoS) condition or enable an attacker to execute arbitrary code with elevated privileges.
To fix this vulnerability, update the Linux Kernel to version 5.4.114 or later, which includes the necessary fix.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
