CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the netfilter component, specifically the xt_nat target handlers, which can lead to a NULL pointer dereference when handling unsupported IP-family connections. This could potentially crash the system if exploited through a bridge-family compat rule. System administrators and developers working with Linux kernel networking should prioritize this fix to ensure stability and prevent potential denial-of-service scenarios.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target families xt_nat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can therefore trigger a NULL-dereference in nf_nat_setup_info(). Reject non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT compat users and leave the runtime fast path unchanged. [ The crash was fixed via 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), so this patch is no longer critical. Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra family check is a good idea in any case. ]