Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_nat: reject unsupported target families
xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
is present and can dereference a NULL pointer when instantiated from an
unsupported family through nft_compat. A bridge-family compat rule can
therefore trigger a NULL-dereference in nf_nat_setup_info().
Reject non-IP families in xt_nat_checkentry() so unsupported targets
cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
compat users and leave the runtime fast path unchanged.
[ The crash was fixed via
9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"),
so this patch is no longer critical.
Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra
family check is a good idea in any case. ]
A flaw was found in the Linux kernel's netfilter component, specifically within the xt_nat SNAT and DNAT target handlers. These handlers incorrectly assume the presence of an IP-family connection tracking state. A local attacker, by instantiating these handlers from an unsupported family, such as a bridge-family, through nft_compat, could trigger a NULL pointer dereference. This vulnerability could lead to a system crash, resulting in a Denial of Service (DoS).
Отчет
A MODERATE severity flaw was found in the Linux kernel's netfilter xt_nat component, affecting the kernel and kernel-rt packages as shipped in Red Hat Enterprise Linux 7, 8, 9 and 10. The xt_nat SNAT and DNAT target handlers assume that IP-family connection tracking state is present; when such a target is instantiated from an unsupported family, such as a bridge-family rule installed through nft_compat, nf_nat_setup_info() may dereference a NULL pointer. A local attacker with the ability to install netfilter rules (for example via CAP_NET_ADMIN) could use this to crash the kernel, causing a denial of service; there is no supported path to information disclosure, privilege escalation or data modification. Red Hat Enterprise Linux 6 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. The fix for the affected RHEL streams is currently deferred: upstream indicates that the crash path was already addressed by a separate nft_compat change that rejects non-bridge targets in ebtables emulation, so the additional xt_nat family check is defensive hardening, and the residual risk on deferred streams is that a local privileged user could trigger a kernel panic. Red Hat rates this flaw MODERATE (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVEORG rating of 7.3 IMPORTANT, because exploitation requires local access with privileges to install netfilter rules and the impact is limited to availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]
In the Linux kernel, the following vulnerability has been resolved: n ...
EPSS
5.5 Medium
CVSS3