GHSA-jr8j-2jhp-m67v — talos
GHSA-jr8j-2jhp-m67v is a security vulnerability in github.com/siderolabs/talos. A fix is available for github.com/siderolabs/talos — see the affected versions and patch details below.
nftables binding to an already bound chain
Real-World Exposure
github.com/siderolabs/talosReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel. A denial of service can occur upon binding to an already bound chain.
Affected by this vulnerability is the function nft_verdict_init of the file net/netfilter/nf_tables_api.c. The manipulation with an unknown input leads to a denial of service vulnerability. The program does not release or incorrectly releases a resource before it is made available for re-use.
Patches
The fix has been backported to 5.15.64 version of the upstream Linux kernel (5.15 is the upstream Kernel long term version Talos ships with). Talos >= v1.2.0 is shipped with Linux Kernel 5.15.64 fixing the above issue.
Workarounds
It's recommended to upgrade
References
- https://www.sesin.at/2022/09/02/cve-2022-39190-linux-kernel-up-to-5-19-5-nf_tables_api-c-nft_verdict_init-denial-of-service/
- https://nvd.nist.gov/vuln/detail/CVE-2022-39190
For more information
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/siderolabs/talos | all versions | 1.2.0go get github.com/siderolabs/talos@v1.2.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/siderolabs/talos, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/siderolabs/talos to 1.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jr8j-2jhp-m67v is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-jr8j-2jhp-m67v can be triaged on real exposure rather than presence alone.
Tailored to GHSA-jr8j-2jhp-m67v. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-jr8j-2jhp-m67v in your dependencies?
O3 Security finds GHSA-jr8j-2jhp-m67v across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.