Loading vulnerability…
Local buffer overflow in Linux kernel Netfilter conntrack netlink parsing
CVE-2020-25211 is a local buffer-overflow vulnerability in the Linux kernel Netfilter connection-tracking netlink subsystem, affecting kernels through 5.8.7. Insufficient validation of layer-3 protocol numbers in ctnetlink_parse_tuple_filter(), and ctnetlink_parse_tuple() in older code paths, allows an attacker able to inject conntrack netlink configuration to overflow a local buffer. Exploitation can crash the kernel or cause incorrect protocol numbers to be used during tuple parsing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a kernel crash and system-wide denial of service, or corrupt protocol-number handling in connection-tracking tuple parsing. Red Hat rates potential confidentiality, integrity, and availability impacts as high, although a specific code-execution or information-disclosure mechanism is not established. Exposure is greater on RHEL 8 because default support for unprivileged user and network namespaces can make the vulnerable interface accessible to otherwise unprivileged local users.
If you can’t patch tonight, do this now.
Prevent the nf_conntrack_netlink kernel module from loading where its functionality is unnecessary. On RHEL 8 systems that require the module, disable unprivileged user namespaces by setting user.max_user_namespaces to 0. Disabling unprivileged namespaces reduces exposure but does not eliminate the attack path for users or processes that already possess the necessary CAP_NET_ADMIN privileges.
Patch, then assume compromise.
Install a vendor-supported kernel update addressing CVE-2020-25211 and reboot into the updated kernel. The upstream fix restricts the layer-3 protocol value to NFPROTO_IPV4 or NFPROTO_IPV6 and returns -EOPNOTSUPP for unsupported values. Fixed Red Hat builds include 3.10.0-1160.21.1.el7 for RHEL 7, 4.18.0-147.38.1.el8_1 for RHEL 8.1 EUS, and 4.18.0-193.46.1.el8_2 for RHEL 8.2 EUS; use the appropriate fixed or superseding package for the installed support stream. Supported RHEL 8.2 deployments can alternatively apply the corresponding kernel live patch supplied through RHSA-2021:0763 without a conventional reboot.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.