Bug 1547824 (CVE-2018-1065) - CVE-2018-1065 kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash
Summary: CVE-2018-1065 kernel: netfilter: xtables NULL pointer dereference in ip6_tabl...
Alias: CVE-2018-1065
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1547827 1547831 1550791
Blocks: 1542365
TreeView+ depends on / blocked
Reported: 2018-02-22 03:32 UTC by Sam Fowler
Modified: 2021-02-17 00:47 UTC (History)
43 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the netfilter/iptables subsystem. A user with the netfilter modification capabilities could insert a rule which could panic the system.
Clone Of:
Last Closed: 2019-06-08 03:40:49 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2948 0 None None None 2018-10-30 08:58:02 UTC

Description Sam Fowler 2018-02-22 03:32:40 UTC
The Linux kernel at version 4.15.0-rc9 is vulnerable to a NULL pointer dereference ip6_tables.c:ip6t_do_table() leading to a crash. This vulnerability is only present under certain malformed iptables rulesets.

Inserting malformed rules its a privileged operation as root or a user with CAP_NET_RAW,CAP_NET_ADMIN capabilities ( see man setcap(8) ).

As this requires advanced privileges Red Hat Product Security has rated this flaw as moderate.

Additional References:

Netdev list:

A suggested upstream patch:

An upstream patch:

Comment 3 Sam Fowler 2018-02-22 04:12:55 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1547831]

Comment 10 errata-xmlrpc 2018-10-30 08:57:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:2948

Note You need to log in before you can comment on or make changes to this bug.