conntrack-tools bug fix update

An update is available for conntrack-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The conntrack-tools packages enable the user to set up a High...

SUSE CVE-2023-52927

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nfctfindexpectation Currently nfconntrackin calling nfctfindexpectation will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the...

DEBIAN-CVE-2023-52927

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nfctfindexpectation Currently nfconntrackin calling nfctfindexpectation will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the...

CVE-2023-52927

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nfctfindexpectation Currently nfconntrackin calling nfctfindexpectation will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the...

Linux Distros Unpatched Vulnerability : CVE-2022-49561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing,...

Linux Distros Unpatched Vulnerability : CVE-2022-48974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using thiscpuadd in preemptible Currently in...

Linux Distros Unpatched Vulnerability : CVE-2021-47408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: conntrack: serialize hash resizes and cleanups Syzbot was able to trigger the following warning 1 No repro found by syzbot yet but I was able to...

SUSE CVE-2022-49110

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 "netfilter: conntrack: collect all entries in one cycle" conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large...

SUSE CVE-2022-49561

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49561

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

DEBIAN-CVE-2022-49183

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix ref leak when switching zones When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcfctskbnfctcached returns fals...

CVE-2022-49110

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 "netfilter: conntrack: collect all entries in one cycle" conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large...

DEBIAN-CVE-2022-49110

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 "netfilter: conntrack: collect all entries in one cycle" conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large...

UBUNTU-CVE-2022-49110

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 "netfilter: conntrack: collect all entries in one cycle" conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large...

CVE-2022-49561 netfilter: conntrack: re-fetch conntrack after insertion

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49561 netfilter: conntrack: re-fetch conntrack after insertion

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49561

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb-nfct and set skb-nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the...

CVE-2022-49561

CVE-2022-49561 concerns a race in Linux kernel netfilter conntrack handling where, on insertion conflicts, skb->_nfct can be freed and rebound to an already-confirmed conntrack entry. The issue arises because conntrack entries and extension space can be freed after an RCU grace period, and the...

CVE-2022-49110

CVE-2022-49110 affects Linux kernel netfilter conntrack, where the gc autotuning change (as of commit 4608fdfc07e1) alters conntrack garbage collection frequency from every 2 minutes and changes eviction behavior. In large conntrack hash tables, evictions skew toward the GC path, risking netlink ...

CVE-2022-49110 netfilter: conntrack: revisit gc autotuning

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 "netfilter: conntrack: collect all entries in one cycle" conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large...