Linux Kernel Netfilter TCP Connection Management Vulnerability

A vulnerability in the Linux kernel's TCP connection tracking can force a connection into the CLOSE state using a RESET packet with an invalid sequence number. This issue arises because the connection tracking logic does not properly verify the direction of the packet in relation to the expected response. As a result, a crafted sequence of packets can prematurely terminate active network address translation (NAT) entries, disrupting ongoing connections.

Impact

Exploitation of this vulnerability can lead to premature termination of active NAT entries, causing disruption of ongoing network connections.

Reproduction

To reproduce this vulnerability, send a SYN packet followed by a RESET packet that contains an invalid sequence number. The RESET packet should be sent in a direction that does not correspond to the expected reply, bypassing the connection tracking's direction validation. This sequence will force the connection into the CLOSE state, prematurely terminating the NAT entry.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the documentation for the specific Linux distribution in use.