Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nft_bitwise expressions that perform left and right bit shifts.

The issue arises because zero shift operands were not properly rejected during initialization. The carry propagation logic calculates the carry from an adjacent 32-bit word using the formula BITS_PER_TYPE(u32) - shift. When the shift operand is zero, this calculation effectively becomes a 32-bit shift, which is undefined behavior.

The fix involves rejecting zero shift operands in the control plane, along with existing checks for shift values greater than or equal to 32, ensuring that malformed rules do not reach the packet processing path.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by rejecting zero shift operands in nft_bitwise left and right shift expressions during initialization, preventing malformed rules from reaching the packet path.

To mitigate this vulnerability, ensure your Linux kernel is updated to a version that includes this fix, which rejects zero shift operands in the control plane.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability involves the Linux kernel's netfilter component where zero shift operands in nft_bitwise left and right shift expressions cause undefined behavior during initialization.

If exploited, malformed rules with zero shift operands could potentially reach the packet path, leading to unpredictable behavior in packet filtering or firewall rules.

However, the vulnerability has been resolved by rejecting zero shift operands in the control plane, preventing malformed rules from affecting packet processing.

Useful 0 Not Useful 0