CVE-2014-8160

Published: 31 December 2014

net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.

From the Ubuntu Security Team

A restriction bypass was discovered in iptables when conntrack rules are specified and the conntrack protocol handler module is not loaded into the Linux kernel. This flaw can cause the firewall rules on the system to be bypassed when conntrack rules are used.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160
• http://www.spinics.net/lists/netfilter-devel/msg33430.html
• https://ubuntu.com/security/notices/USN-2513-1
• https://ubuntu.com/security/notices/USN-2514-1
• https://ubuntu.com/security/notices/USN-2515-1
• https://ubuntu.com/security/notices/USN-2516-1
• https://ubuntu.com/security/notices/USN-2517-1
• https://ubuntu.com/security/notices/USN-2518-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1413109