CVE-2022-49911

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: enforce documented limit to prevent allocating huge memory

Daniel Xu reported that the hash:net,iface type of the ipset subsystem does

not limit adding the same network with different interfaces to a set, which

can lead to huge memory usage or allocation failure.

The quick reproducer is

$ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0

$ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done

The backtrace when vmalloc fails:

[Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages

<...>

[Tue Oct 25 00:13:08 2022] Call Trace:

[Tue Oct 25 00:13:08 2022] <TASK>

[Tue Oct 25 00:13:08 2022] dump_stack_lvl+0x48/0x60

[Tue Oct 25 00:13:08 2022] warn_alloc+0x155/0x180

[Tue Oct 25 00:13:08 2022] __vmalloc_node_range+0x72a/0x760

[Tue Oct 25 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References