Detections
Analytics

Echo: linux: security update to 6.1.133-1

medium Tenable Cloud Security Plugin ID 463778

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple
 for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original
 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly
 check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this
 conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same
 logic to nf_sk_lookup_slow_v6. IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods'
 addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium
 leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables
 prerouting rule that matches on `-m socket --transparent` and redirects the packets to localhost, but it
 fails to match SNATed IPv6 packets due to that missing conntrack lookup. (CVE-2025-22021)

Solution

Update the linux library and its related packages to version 6.1.133-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-22021

Plugin Details

Severity: Medium

ID: 463778

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.19

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-22021

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 4/14/2025

Reference Information

CVE: CVE-2025-22021