In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check<\/p>\n
An unintended behavior in the TCP conntrack state machine allows a
\nconnection to be forced into the CLOSE state using an RST packet with an
\ninvalid sequence number.<\/p>\n
Specifically, after a SYN packet is observed, an RST with an invalid SEQ
\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of
\nwhether the RST corresponds to the expected reply direction. The relevant
\ncode path assumes the RST is a response to an outgoing SYN, but does not
\nvalidate packet direction or ensure that a matching SYN was actually sent
\nin the opposite direction.<\/p>\n
As a result, a crafted packet sequence consisting of a SYN followed by an
\ninvalid-sequence RST can prematurely terminate an active NAT entry. This
\nmakes connection teardown easier than intended.<\/p>\n
So, tighten the state transition logic to ensure that RST-triggered
\nCLOSE transitions only occur when the RST is a valid response to a
\npreviously observed SYN in the correct direction.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check<\/p>\n
An unintended behavior in the TCP conntra<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14951","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}