CVE-2019-11360: Buffer Overflow
A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to addparamtoargv in xshared.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs high privileges on the local system and must induce a user to run iptables-restore with a specially crafted iptables-save file. The CVSS vector indicates local access, high privileges, and user interaction are required.
What is the likely impact if exploitation succeeds?
A crafted input can at least crash iptables-restore, causing a local denial of service. The vulnerability may also allow code execution, although the provided information does not confirm the privileges under which that code would run.
Which component and input should be prioritized for investigation?
Focus on uses of iptables-restore that consume iptables-save files, particularly files obtained from untrusted or externally supplied sources. The affected code is identified as add_param_to_argv in xshared.c.
Is a fix available?
Yes. A patch is available; the supplied reference includes the upstream commit addressing the issue.