Описание
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_nat: fully initialise new_addr in netmap setup
nft_nat_setup_netmap() builds the mapped address in an on-stack
union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip
member and the loop runs a single 32-bit iteration, but it then copies
the whole 16-byte union into range->min_addr and range->max_addr, so the
upper 12 bytes reach nf_nat_setup_info() uninitialised.
KMSAN reports an uninit-value in nf_nat_setup_info() reached from
nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.
Zero-initialise new_addr.
A flaw was found in the Linux kernel's Netfilter network filtering subsystem. When configuring IPv4 Network Address Translation (NAT) rules with the netmap feature, the system fails to initialize a temporary memory buffer on the stack. As a result, uninitialized kernel stack data is copied and processed during packet evaluation. A local user with network administration privileges can exploit this flaw to cause unexpected system behavior, leading to a Denial of Service (DoS) or the potential disclosure of sensitive kernel memory.
Отчет
A flaw rated Moderate impact affects the Linux kernel's netfilter nftables NAT implementation in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases built on RHEL CoreOS 9. When an IPv4 NAT rule using the nftables netmap feature is configured, nft_nat_setup_netmap() writes only the 4-byte IPv4 member of the 16-byte on-stack union nf_inet_addr before copying the whole union into the NAT range, so up to 12 bytes of uninitialized kernel stack data reach nf_nat_setup_info() and are processed during packet evaluation. A local user with the network administration privileges (CAP_NET_ADMIN) needed to configure nftables rules could exploit this flaw to cause a denial of service, and the processed uninitialized stack data could potentially expose limited kernel memory, although no information disclosure has been demonstrated. The IPv6 netmap path initializes all 16 bytes of the union and is not affected. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform releases built on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those releases. For the affected products, the fix is currently deferred: given the moderate impact of the flaw and the requirement for local administrative privileges to trigger it, a fix is not planned for these releases at this time. The residual risk is that systems using IPv4 netmap NAT rules may experience a denial of service or, at most, limited exposure of uninitialized kernel stack data.
Меры по смягчению последствий
This flaw is only reachable through nftables IPv4 NAT rules that use the netmap feature. Avoiding the netmap option when configuring IPv4 NAT rules, and using explicit address ranges for the required translations instead, avoids the affected code path. For deployments where this is not practical, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.
netfilter: nft_nat: fully initialise new_addr in netmap setup
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit iteration, but it then copies the whole 16-byte union into range->min_addr and range->max_addr, so the upper 12 bytes reach nf_nat_setup_info() uninitialised. KMSAN reports an uninit-value in nf_nat_setup_info() reached from nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected. Zero-initialise new_addr.
EPSS
5.5 Medium
CVSS3