Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
was skipped") introduced a regression where packets for valid
connections are dropped when using connlimit for soft-limiting
scenarios.
The issue occurs when a new connection reuses a socket currently in
the TIME_WAIT state. In this scenario, the connection tracking entry
is evaluated as already confirmed. Previously, __nf_conncount_add()
assumed that if a connection was confirmed and did not originate from
the loopback interface, it should skip the addition and return -EEXIST.
Skipping the addition triggers a garbage collection run that cleans up
the TIME_WAIT connection. Consequently, the active connection count
drops to 0, which xt_connlimit mishandles, leading to the false rejection
of the perfectly valid new connection.
Fix this by replacing the interface check with protocol-agnostic state
checks. We now skip the tree insertion and preserve the lockless garbage
collection optimization only if the connection is IPS_ASSURED. This
allows early-confirmed setup packets (such as reused TIME_WAIT sockets
or locally generated SYN-ACKs) to be properly evaluated and counted
without falsely dropping. The goto check_connections path is maintained
to ensure these setup packets are deduplicated correctly.
This has been tested with slowhttptest and HTTP server configured
locally to ensure we are not breaking soft-limiting scenarios for local
or external connections. In addition, it was tested with a OVS zone
limit too.
A flaw was found in the Linux kernel's netfilter connection tracking module. When a new network connection attempts to reuse a socket that is in a temporary waiting state after closing, the system incorrectly identifies it as an already confirmed connection. This misidentification causes the connection limiting feature to drop valid network packets, leading to a denial of service where legitimate connections are falsely rejected by a remote attacker.
Отчет
A moderate-impact denial-of-service flaw was found in the Linux kernel's netfilter connection counting (nf_conncount) code, which backs the connlimit feature used by iptables xt_connlimit and nftables nft_connlimit rules. A regression in this code causes packets for valid connections to be dropped when connlimit is used for soft-limiting: when a new connection reuses a socket that is in the TIME_WAIT state, its connection tracking entry is evaluated as already confirmed, the connection is skipped from being added to the count, and a subsequent garbage collection run removes the old TIME_WAIT entry. The active connection count then drops to zero, which xt_connlimit mishandles by falsely rejecting the new, legitimate connection. A remote attacker who can reach a service protected by a connlimit rule can trigger this behavior through normal connection attempts, causing a denial of service in which valid new connections are rejected; there is no impact to confidentiality or integrity. Within Red Hat's product portfolio, only the kernel in Red Hat Enterprise Linux 10.3 contains this regression; other Red Hat Enterprise Linux streams and Red Hat In-Vehicle OS versions do not contain the vulnerable code and are therefore not affected. The fix for the affected RHEL 10.3 stream has been deferred to a future update. Because the flaw is an availability-only regression that requires administrator-configured connlimit rules to be in use, the residual risk is limited to systems with such rules: legitimate connections that reuse TIME_WAIT sockets may be falsely dropped, reducing the availability of the protected service, but the flaw does not allow memory corruption, privilege escalation, or any impact beyond connection rejection. The upstream CVE record rates this flaw as important (CVSS 3.1 score 7.5, network attack vector, no privileges required), while Red Hat rates it moderate (CVSS 3.1 score 5.5): successful exploitation depends on administrator-configured connlimit rules and on connection-reuse timing, and the consequence is limited to the availability of connections matched by those rules.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid connections are dropped when using connlimit for soft-limiting scenarios. The issue occurs when a new connection reuses a socket currently in the TIME_WAIT state. In this scenario, the connection tracking entry is evaluated as already confirmed. Previously, __nf_conncount_add() assumed that if a connection was confirmed and did not originate from the loopback interface, it should skip the addition and return -EEXIST. Skipping the addition triggers a garbage collection run that cleans up the TIME_WAIT connection. Consequently, the active connection count drops to 0, which xt_connlimit mishandles, leading to the false rejection of the perfectly valid new connection. Fix this by replacing the interface check with pro...
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") introduced a regression where packets for valid connections are dropped when using connlimit for soft-limiting scenarios. The issue occurs when a new connection reuses a socket currently in the TIME_WAIT state. In this scenario, the connection tracking entry is evaluated as already confirmed. Previously, __nf_conncount_add() assumed that if a connection was confirmed and did not originate from the loopback interface, it should skip the addition and return -EEXIST. Skipping the addition triggers a garbage collection run that cleans up the TIME_WAIT connection. Consequently, the active connection count drops to 0, which xt_connlimit mishandles, leading to the false rejection of the perfectly valid new connection. Fix this by replacing the interface check with p
In the Linux kernel, the following vulnerability has been resolved: n ...
EPSS
5.5 Medium
CVSS3