Bug 8618

Summary:	iptables has open CVE: CVE-2012-2663
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Elena Reshetova <elena.reshetova>
Component:	connectivity	Assignee:	Armin Kuster <akuster>
Status:	RESOLVED WONTFIX	QA Contact:
Severity:	normal
Priority:	Medium	CC:	akuster, meta.mr.watcher, meta.watcher
Version:	unspecified
Target Milestone:	2.0.1
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	No (bug/feature does not impact docs)

Description Elena Reshetova 2015-10-30 07:02:00 UTC

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2663

Comment 1 Armin Kuster 2016-02-16 22:38:59 UTC

wont fix. this affects older kernels and trying to fix this in iptables will most likely branch backward compatibility.

Mitigation:

Instead of --syn use --tcp-flags SYN,RST,ACK SYN in your rulesets in case you want to also match packets with both SYN+FIN flags set.