Mitigation Strategies

The vulnerability has been resolved by rejecting malformed multiport v1 rules in the Linux kernel's netfilter xt_multiport module. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the xt_multiport module. The issue arises because the function ports_match_v1() incorrectly treats any non-zero pflags entry as the start of a port range and automatically consumes the next ports[] element as the range end without proper validation.

The checkentry path validates protocol, flags, and count but does not validate the range encoding itself. This allows malformed rules to either mark the last slot as a range start or place two range starts consecutively, causing ports_match_v1() to read beyond the last valid ports[] element when interpreting the rule.

The fix involves rejecting malformed multiport v1 rules by ensuring that each range start has a following element and that the following element is not itself marked as another range start.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability in the Linux kernel's netfilter xt_multiport module can lead to improper handling of malformed port range rules. Specifically, the ports_match_v1() function may incorrectly interpret port ranges, potentially causing it to read beyond the last valid port element. This could result in unexpected behavior in firewall rule processing, which might affect network traffic filtering and security enforcement.

Useful 0 Not Useful 0