CVE-2014-8160: Input Validation
It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.
Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT
[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html
Other sources
net/netfilter/nfconntrackprotogeneric.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8160?
CVE-2014-8160 is considered a medium severity vulnerability due to its impact on network traffic filtering.
How do I fix CVE-2014-8160?
To fix CVE-2014-8160, update to the latest patched version of the affected Linux kernel or iptables.
What systems are affected by CVE-2014-8160?
CVE-2014-8160 affects various Linux distributions including Debian, Ubuntu, and Red Hat, particularly those running specified versions of the Linux kernel.
What type of vulnerability is CVE-2014-8160?
CVE-2014-8160 is a vulnerability in the iptables firewall implementation related to the handling of unsupported protocols.
Is CVE-2014-8160 exploitable remotely?
Yes, CVE-2014-8160 can potentially be exploited remotely if the iptables rules are not correctly configured, allowing unauthorized traffic.