firehol

FireHOL http://firehol.org/ FireHOL, an iptables stateful packet filtering firewall for humans! FireQOS, a TC based bandwidth shaper for humans! Git These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade Notes. Cloning...

CVE-2016-0846-PoC

CVE-2016-0846-PoC...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Members : Abhishek Rungta, Shubham Saini, Siddhant Sood Environment Setup A linux VM Such as Ubuntu 20.04 Minikube for local deploymnet of kubernetes Any of these older versions1.0.x— 1.9.x, 1.10.0—1.10.10,1.11.0—1.11.4,1.12.0—1.12.2 Run the exploit We have...

kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP Transmission Control Protocol packets, specifically a SYN synchronize packet followed by an RST reset packet with an invali...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151131)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151131 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels...

CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

UBUNTU-CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

SUSE CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

DEBIAN-CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

CVE-2026-99283 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

EUVD-2026-119327

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

CVE-2026-99283 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

CVE-2026-99283

The Linux kernel contains a vulnerability in the netfilter: conntrack component where the system incorrectly selects the TCP_CONNTRACK_CLOSE timeout for all RST packets, regardless of the actual state transition. Specifically, when an in-window RST packet does not match the expected sequence numb...

Linux Distros Unpatched Vulnerability : CVE-2026-99283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 netfilter: conntrack: tcp: only close if RST matches exact sequence...

PT-2026-139721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter conntrack TCP implementation where the timeout selection is based on the packet type rather than the state transition result. When a Reset RST packet is...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs accept an opts pointer along with an optssz argument. The verifier checks only the memory range specified by optssz; however, the wrappers...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This results in a state confusion bug when the raw tab...

CVE-2026-122266

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 VPC CNI before 1.22.3 might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AFPACKE...