CVE-2012-6638
published 2014-02-15CVE-2012-6638: The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel…
PriorityP434high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
3.34%
87.4th percentile
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | iptables | — | — |
| debian | linux | < linux 3.2.29-1 (bookworm) | linux 3.2.29-1 (bookworm) |
| linux | linux_kernel | < 3.0.38 | 3.0.38 |
| linux | linux_kernel | >= 0 < 3.2.29-1 | 3.2.29-1 |
| linux | linux_kernel | >= 0 < 3.2.29-1 | 3.2.29-1 |
| linux | linux_kernel | >= 0 < 3.2.29-1 | 3.2.29-1 |
| linux | linux_kernel | >= 0 < 3.2.29-1 | 3.2.29-1 |
| linux | linux_kernel | >= 3.1 < 3.2.24 | 3.2.24 |
| netfilter | iptables | <= 1.4.21 | — |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (EC2) vulnerability
vendor_ubuntu·2012-12-04·CVSS 4.7
CVE-2012-4565 [MEDIUM] Linux kernel (EC2) vulnerability
Title: Linux kernel (EC2) vulnerability
Summary: The system could be made to run programs as an administrator.
Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois
congestion control algorithm. A local attacker could use this to cause a
denial of service. (CVE-2012-4565)
Mathias Krause discovered an information leak in the Linux kernel's TUN/TAP
device driver. A local user could exploit this flaw to examine part of the
kernel's stack memory. (CVE-2012-6547)
Denys Fedoryshchenko discovered a flaw in the Linux kernel's TCP receive
processing for IPv4. A remote attacker could exploit this flaw to cause a
denial of service (kernel resource consumption) via a flood of SYN+FIN TCP
packets. (CVE-2012-6638)
A flaw was discovered in the requeuing of futexes in the Linux kernel.
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2012-11-30·CVSS 4.7
CVE-2012-4565 [MEDIUM] Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash under certain conditions.
Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois
congestion control algorithm. A local attacker could use this to cause a
denial of service. (CVE-2012-4565)
Mathias Krause discovered an information leak in the Linux kernel's TUN/TAP
device driver. A local user could exploit this flaw to examine part of the
kernel's stack memory. (CVE-2012-6547)
Denys Fedoryshchenko discovered a flaw in the Linux kernel's TCP receive
processing for IPv4. A remote attacker could exploit this flaw to cause a
denial of service (kernel resource consumption) via a flood of SYN+FIN TCP
packets. (CVE-2012-6638)
A flaw was discovered in the requeuing of futexes in the Linux kernel. A
local
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-08-10·CVSS 5.2
CVE-2012-2119 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel's macvtap device driver, which is
used in KVM (Kernel-based Virtual Machine) to create a network bridge
between host and guest. A privleged user in a guest could exploit this flaw
to crash the host, if the vhost_net module is loaded with the
experimental_zcopytx option enabled. (CVE-2012-2119)
An error was discovered in the Linux kernel's network TUN/TAP device
implementation. A local user with access to the TUN/TAP interface (which is
not available to unprivileged users until granted by a root user) could
exploit this flaw to crash the system or potential gain administrative
privileges. (CVE-2012-2136)
A flaw was found in how the Linux kernel's KVM (
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2012-08-10·CVSS 5.2
CVE-2012-2119 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel's macvtap device driver, which is
used in KVM (Kernel-based Virtual Machine) to create a network bridge
between host and guest. A privleged user in a guest could exploit this flaw
to crash the host, if the vhost_net module is loaded with the
experimental_zcopytx option enabled. (CVE-2012-2119)
An error was discovered in the Linux kernel's network TUN/TAP device
implementation. A local user with access to the TUN/TAP interface (which is
not available to unprivileged users until granted by a root user) could
exploit this flaw to crash the system or potential gain administrative
privileges. (CVE-2012-2136)
A flaw was found in how the Linux kernel
Debian
CVE-2012-2663: iptables - extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN pac...
vendor_debian·2012·CVSS 7.5
CVE-2012-2663 [HIGH] CVE-2012-2663: iptables - extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN pac...
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2012-6638: linux - The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel b...
vendor_debian·2012·CVSS 7.5
CVE-2012-6638 [HIGH] CVE-2012-6638: linux - The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel b...
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
Scope: local
bookworm: resolved (fixed in 3.2.29-1)
bullseye: resolved (fixed in 3.2.29-1)
forky: resolved (fixed in 3.2.29-1)
sid: resolved (fixed in 3.2.29-1)
trixie: resolved (fixed in 3.2.29-1)
Red Hat
iptables: --syn flag bypass
vendor_redhat·2011-12-02·CVSS 7.5
CVE-2012-2663 [HIGH] iptables: --syn flag bypass
iptables: --syn flag bypass
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
Statement: This issue does affect Red Hat Enterprise Linux 5 and 6.
The risks in breaking compatability associated with fixing this flaw outweigh the benefits of the fix, therefore Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux 5 and 6.
Please note that the remote DoS issue in the way how Linux kernel treats SYN+FIN flags set is being handled under different CVE, CVE-2012-6638, and is planned to be fixed in all affected Red Hat Enterprise Linux releases.
Mitigation: Instead of --syn use
Red Hat
Kernel: net: tcp: potential DoS via SYN+FIN messages
vendor_redhat·2011-12-02·CVSS 7.5
CVE-2012-6638 [HIGH] Kernel: net: tcp: potential DoS via SYN+FIN messages
Kernel: net: tcp: potential DoS via SYN+FIN messages
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
GHSA
GHSA-wq3v-5978-56ch: The tcp_rcv_state_process function in net/ipv4/tcp_input
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2012-6638 [HIGH] CWE-400 GHSA-wq3v-5978-56ch: The tcp_rcv_state_process function in net/ipv4/tcp_input
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
GHSA
GHSA-g725-p8m6-82j4: extensions/libxt_tcp
ghsa_unreviewed·2022-05-13·CVSS 7.8
CVE-2012-2663 [HIGH] GHSA-g725-p8m6-82j4: extensions/libxt_tcp
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
OSV
CVE-2012-2663: extensions/libxt_tcp
osv·2014-02-15·CVSS 7.5
CVE-2012-2663 [HIGH] CVE-2012-2663: extensions/libxt_tcp
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
OSV
CVE-2012-6638: The tcp_rcv_state_process function in net/ipv4/tcp_input
osv·2014-02-15·CVSS 7.5
CVE-2012-6638 [HIGH] CVE-2012-6638: The tcp_rcv_state_process function in net/ipv4/tcp_input
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-6638 Kernel: net: tcp: potential DoS via SYN+FIN messages
bugzilla·2014-02-17·CVSS 7.8
CVE-2012-6638 [HIGH] CVE-2012-6638 Kernel: net: tcp: potential DoS via SYN+FIN messages
CVE-2012-6638 Kernel: net: tcp: potential DoS via SYN+FIN messages
Linux kernel built with the TCP/IP networking support(CONFIG_INET) is
vulnerable to a possible DoS attack. It could occur when accepting new TCP
connection requests with 'SYN+FIN' flags instead of only 'SYN' flag set.
A remote user/program could use this flaw to cause DoS by sending multiple
connection requests to a machine.
Upstream fix:
-> https://git.kernel.org/linus/fdf5af0daf8019cec2396cdef8fb042d80fe71fa
Discussion:
Statement:
This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2014:0433 https://rhn.redhat.com/errata/RHSA-2014-0433.html
---
Bugzilla
CVE-2012-2663 iptables: --syn flag bypass
bugzilla·2012-05-30·CVSS 7.5
CVE-2012-2663 [HIGH] CVE-2012-2663 iptables: --syn flag bypass
CVE-2012-2663 iptables: --syn flag bypass
Originally reported as a DoS related issue:
http://git.kernel.org/?p=linux/kernel/git/davem/net-next.git;a=commitdiff;h=fdf5af0daf8019cec2396cdef8fb042d80fe71fa
Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his
linux machines to their limits.
Dont call conn_request() if the TCP flags includes SYN flag
---
This issue also allows bypass of --syn rules in iptables:
http://www.spinics.net/lists/netfilter-devel/msg21248.html
Unfortunately, with current stable Linux kernel release (as well as
with most of the previous versions) blocking TCP packets with the SYN
bit set and the ACK,RST and FIN bits cleared won't prevent incoming
TCP connections.
It should be noted that the combination of SYN+FIN in a TCP-IP packet is generally
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fdf5af0daf8019cec2396cdef8fb042d80fe71fahttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24https://bugzilla.redhat.com/show_bug.cgi?id=826702https://github.com/torvalds/linux/commit/fdf5af0daf8019cec2396cdef8fb042d80fe71fahttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fdf5af0daf8019cec2396cdef8fb042d80fe71fahttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24https://bugzilla.redhat.com/show_bug.cgi?id=826702https://github.com/torvalds/linux/commit/fdf5af0daf8019cec2396cdef8fb042d80fe71fa
2014-02-15
Published