vallumd

vallumd 이 프로그램은 IP 블랙리스트를 중앙화하고 배포할 수 있도록 해줍니다. 인터넷에서 서버를 운영하다 보면 하나 이상의 무차별 대입 공격을 겪었을 가능성이 높습니다. 문제없습니다. 그냥 fail2ban을 설치하면 됩니다. 끝. 하지만 여러 대의 서버를 운영하고 있고 각 서버가 자신의 fail2ban 인스턴스를 실행 중이라면, 각각의 차단 목록에 서로 다른 IP 주소가 있을 것입니다. 모든 fail2ban 인스턴스에서 공유되는 차단 목록이 있다면 좋지 않을까요? 또는 모든 머신이 자신이 제어하는 라우터나 방화벽 뒤에...

CFC

중앙 집중식 방화벽 제어 스크립트 중앙 집중식 방화벽 제어는 iptables를 실행하는 여러 서버 또는 로드밸런서의 방화벽을 중앙에서 관리할 수 있는 방법을 제공합니다. 이를 통해 여러 서버에서 하나의 명령으로 남용abuse IP 범위 등을 빠르게 허용/차단/삭제/검색할 수 있습니다. 해당 서버에는 ssh를 통해 접근합니다. IPv4와 IPv6를 모두 지원합니다. Debian 6.x / 7.x / 8.x / 9.x에서 테스트되었지만 다른 배포판에서도 작동해야 합니다. 사전 요구 사항 IPv6에 대해 'precheck',...

NFtables-IPtables-integration-script

🛡️ Q-Feeds Linux 방화벽 블록리스트 통합 리눅스 서버용 자동화된 악성코드 IP 블록리스트 — nftables 및 iptables+ipset 지원 📋 목차 빠른 시작 개요 작동 방식 사전 요구 사항 상세 설치 가이드 설정 사용 및 확인 문제 해결 제거 라이선스 🚀 빠른 시작 1단계: API 토큰 받기 tip.qfeeds.com에서 무료 API 키를 받으세요. 2단계: 스크립트 다운로드bash git clone...

OESA-2026-4185 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Netfilter: ipset – It is necessary to hold the module reference while requesting a module. The user space may unload the ipset.ko module while it is itself requesting a set-type backend module, resulting in a kernel crash. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ipset: Fixed issues related to region locking in hash types. The region locking mechanism introduced in v5.6-rc4 included three macros for handling region locks: ahashbucketstart, ahashbucketend which return the sta...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: A limit was enforced to prevent the allocation of excessive memory. Daniel Xu reported that the hash:net,iface type of the ipset subsystem does not limit the addition of the same network with different interface...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Added the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c. The missing IPSETHASHWITHNET0 macro in ipsethashnetportnet can lead to the use of the incorrect CIDRPOSc for calculating array offsets, which...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Reworked the handling of long task execution when adding/ deleting entries. When adding or deleting a large number of elements in one step using ipset, it may take considerable time, and soft lockup errors can...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: A overflow issue was fixed in the bitmapipcreate function before the bitmap was widened. When firstip is 0, lastip is 0xFFFFFFFF, and the netmask is 31, the value of an arithmetic expression 2 netmask - maskbits...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073354 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and...

SUSE CVE-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

SUSE CVE-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer called first...

kernel: netfilter: ipset: fix race between dump and ip_set_list resize

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...

SUSE CVE-2026-72436

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use testbit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using testbit which is a relaxed atomic operation and provides no memory barrier guarantees...

kernel-rt security, bug fix, and enhancement update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

CVE-2026-74748

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the list:set garbage collection and set swap operations. This concurrency issue can lead to a kernel bug and a system crash, effectively causing a denial of service. This vulnerability can be trigger...

EUVD-2026-66578

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

SUSE CVE-2026-74748

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

RockyLinux 9 : kernel (RLSA-2026:59723)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59723 advisory. kernel: ksm: use range-walk function to jump over holes in scangetnextrmapitem CVE-2025-68211 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv...