In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_CT: drop pending enqueued packets on template removal
Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:
- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.
The use of templates with zone and event cache filter are safe, since
this just copies values.
Flush these enqueued packets in case the template rule gets removed.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 6
https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b
416baaa9-dc9f-4396-8d5f-8c081fb06d67