Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: release template ct on non-IP path
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.
Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.
A flaw was found in the Linux kernel's netfilter bridge component. This vulnerability allows for a memory leak when the system processes non-IPv4 and non-IPv6 network traffic through a bridge nftables connection tracking rule. The system fails to release an existing connection tracking template reference, leading to a gradual accumulation of unreleased memory. This can ultimately result in a denial of service (DoS) condition as the host runs out of available memory.
Отчет
A moderate-impact flaw was found in the Linux kernel's netfilter bridge code, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. When an nftables rule that sets a connection tracking zone (a "ct zone set" rule) is configured for bridged traffic, it can attach a conntrack template to a socket buffer (skb) before nf_ct_bridge_pre() processes the frame. For frames with non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() overwrites the skb's conntrack state with IP_CT_UNTRACKED without releasing the existing template reference, making the per-cpu template and any temporary templates allocated for concurrent use unreachable. An attacker with layer 2 (network-adjacent) access to a host with such a rule configured can send non-IP frames to the affected bridge to repeatedly trigger this path, gradually leaking kernel slab memory until the host runs out of memory, resulting in a denial of service. Confidentiality and integrity are not affected. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. The upstream CVEORG severity is Important (CVSS 3.1 score 7.5, AV:N/AC:L/PR:N), which differs from Red Hat's Moderate rating (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L) because exploitation requires an administrator-configured nftables bridge connection tracking zone rule and network-adjacent access to send non-IP frames to the bridge, rather than unauthenticated remote network reachability, and the impact is limited to availability. Fixes for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 streams have been deferred to a future update because the flaw only affects availability and requires the specific bridged nftables ct zone configuration to be present; the residual risk is a gradual kernel memory leak that can eventually exhaust memory and cause denial of service on hosts where that configuration is exposed to non-IP traffic from the local network segment.
Меры по смягчению последствий
The memory leak requires an nftables "ct zone set" rule on bridged traffic, which attaches a conntrack template to the skb before nf_ct_bridge_pre() processes non-IP frames. Removing or disabling such "ct zone set" rules for traffic forwarded through a software bridge prevents the conntrack template from being attached on this path and avoids the leak, at the cost of the intended connection tracking zone assignment for that traffic. No other mitigation is currently known.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab. Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab. Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab. Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
EPSS
5.5 Medium
CVSS3