CVE-2018-1065 in Linux
Summary
by MITRE
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2025
The vulnerability described in CVE-2018-1065 represents a critical flaw within the Linux kernel's netfilter subsystem that affects versions through 4.15.7. This issue specifically targets the handling of rule blobs containing jump instructions without associated user-defined chains, creating a condition where a NULL pointer dereference occurs when processing network filtering rules. The vulnerability exists in three primary functions: arpt_do_table in the ARP table processing module, ipt_do_table in the IPv4 table processing module, and ip6t_do_table in the IPv6 table processing module, all of which are part of the kernel's network packet filtering infrastructure.
The technical exploitation of this vulnerability requires an attacker to possess either the CAP_NET_RAW or CAP_NET_ADMIN capabilities, which are Linux capabilities that grant specific network administration privileges. These capabilities allow processes to perform low-level network operations including packet filtering and routing table modifications. When a malicious user with these privileges creates or modifies a netfilter rule that contains a jump instruction pointing to a non-existent user-defined chain, the kernel's rule processing logic fails to properly validate the target chain reference before attempting to dereference it. This failure results in a NULL pointer dereference that causes the kernel to crash and potentially leads to a system-wide denial of service condition.
The operational impact of this vulnerability extends beyond simple system crashes as it can be leveraged by local attackers to disrupt network services and potentially compromise system availability. The denial of service affects the entire kernel's network filtering capabilities, which could impact network connectivity, firewall functionality, and overall system stability. The vulnerability is particularly concerning because it can be triggered through legitimate administrative operations that modify network filter rules, making it difficult to distinguish between legitimate administrative actions and malicious exploitation attempts.
This vulnerability maps to CWE-476 which describes NULL pointer dereference conditions in software systems, and aligns with several ATT&CK techniques including T1059 for command and scripting interpreter and T1490 for infiltration using network protocols. The attack surface is primarily within the kernel's network packet filtering subsystem where rule validation is insufficient to prevent malformed rule structures from causing kernel crashes. Organizations should implement immediate mitigation strategies including kernel updates to versions that address this vulnerability, proper capability management to limit the scope of users with elevated network privileges, and monitoring for unusual network filter rule modifications that could indicate exploitation attempts.
The root cause of this vulnerability stems from inadequate input validation within the netfilter subsystem's rule processing logic. The kernel's rule parsing functions fail to properly verify that jump targets reference existing user-defined chains before attempting to access chain data structures. This validation gap allows malformed rule blobs to propagate through the system and ultimately cause kernel panics when the system attempts to process these invalid rule references. The lack of proper error handling in these critical kernel functions creates a pathway for attackers to systematically destabilize systems through carefully crafted rule modifications that exploit the underlying NULL pointer dereference condition.