Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nf_conncount module which tracks network connections.

After an optimization was made to perform only one garbage collection (GC) per jiffy (a unit of time), a problem was introduced where if more than 8 new connections are tracked in a single jiffy, the connection list would not be cleaned up quickly enough, potentially causing the connection limit to be reached incorrectly.

To fix this, the cleanup limit was increased from 8 to 64 connections, and the GC skipping logic was adjusted to only skip if GC was already triggered during the same jiffy and the increment is below the cleanup limit. This change helps avoid triggering GC too often and makes garbage collection more effective.

Useful 0 Not Useful 0

Impact Analysis

If this vulnerability is present, the system may incorrectly reach the connection tracking limit due to insufficient cleanup of tracked connections when many new connections occur in a short time.

This could lead to degraded network performance or denial of service conditions because new connections might be blocked or mishandled when the connection tracking list appears full.

The fix increases the cleanup limit and improves garbage collection efficiency, helping maintain proper connection tracking and system stability under high connection loads.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability relates to the nf_conncount module in the Linux kernel where connection cleanup limits were too low, causing potential issues when tracking many new connections per jiffy.

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes the fix which increases the connection cleanup limit to 64 and adjusts the garbage collection logic to avoid skipping GC improperly.

Specifically, update your system to the patched kernel version that contains the fix for nf_conncount as described.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability relates to the Linux kernel's netfilter connection tracking and garbage collection mechanism, specifically when more than 8 new connections are tracked per jiffy, potentially causing the connection list to not be cleaned up fast enough.

To detect if your system is affected, you can monitor connection tracking statistics and observe if the connection tracking table is reaching its limits or if there is an unusually high number of pending or connected connections that are not being cleaned up.

Commands that may help in detecting this issue include:

• Check connection tracking table size and usage: sudo cat /proc/net/nf_conntrack or sudo conntrack -L
• Monitor the number of new connections per jiffy by observing system performance tools or custom scripts that track connection creation rates.
• Use tools like 'slowhttptest' to simulate slow HTTP connections and observe connection states, as was done in testing.
• Check kernel logs for any related netfilter or connection tracking warnings or errors.

Useful 0 Not Useful 0