On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote: > A network-adjacent attacker can send packets addressed to a host's VPN > tunnel address over the physical interface. Because Linux uses the weak > host model by default, the host replies, which lets the attacker infer > the tunnel address, confirm active connections and eventually inject > into the tunneled TCP stream. > > No upstream kernel fix exists. The disclosure notes that reverse path > filtering is not a complete solution because the attack also works over > IPv6, which has no rp_filter; the mitigation that shipped was a firewall > rule added to wg-quick(8) in userspace:
We should drop the discussion of mitigations here - none of them are complete mitigations and there are more nuances. > > https://www.openwall.com/lists/oss-security/2019/12/05/1 > https://lore.kernel.org/all/[email protected]/ > > Distribution trackers record the same state: Ubuntu has it deferred > since 2019-12-13, Debian does not track it against the kernel, and Red > Hat scopes it to openvpn: > > https://ubuntu.com/security/CVE-2019-14899 > https://security-tracker.debian.org/tracker/CVE-2019-14899 > > Record it unpatched so it stays visible rather than excluded. > > CC: Paul Barker <[email protected]> > AI-Generated: Uses Claude (claude-opus-5) > Signed-off-by: Junjie Cao <[email protected]> > --- > v3: > - use "unpatched" instead of "upstream-wontfix": there is no upstream > statement, only distribution and disclosure sources > > v2: > https://lore.kernel.org/openembedded-core/[email protected]/ > > meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc > b/meta/recipes-kernel/linux/cve-exclusion.inc > index d27d764..5ed4a00 100644 > --- a/meta/recipes-kernel/linux/cve-exclusion.inc > +++ b/meta/recipes-kernel/linux/cve-exclusion.inc > @@ -192,3 +192,10 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from > 6.18" > # Fix > https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 > # Backport > https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906 > CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" > + > +# Consequence of the default weak host model, not a specific defect; > +# mitigation is firewall configuration only (rp_filter for IPv4, a > +# strong host model rule such as wg-quick(8)'s, which also covers IPv6). > +# https://ubuntu.com/security/CVE-2019-14899 > +CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \ > +host model, no upstream kernel fix, mitigated by firewall configuration" I recommend slightly different wording. Include the triage date, drop discussion of mitigation. # Triaged August 2026 - no upstream fix, Ubuntu fix deferred # https://ubuntu.com/security/CVE-2019-14899 CVE_STATUS[CVE-2019-14899] = "unpatched: Consequence of the default weak host \ model, no upstream fix" Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243528): https://lists.openembedded.org/g/openembedded-core/message/243528 Mute This Topic: https://lists.openembedded.org/mt/120714048/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
