The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000856 advisory.

    The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote     attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a     different vulnerability than CVE-2012-2663.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-405:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
     CVE-2012-4398     The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain     killable attribute, which allows local users to cause a denial of service (memory consumption) via a     crafted application.
     CVE-2012-6638     The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote     attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a     different vulnerability than CVE-2012-2663.
     CVE-2013-2888     Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
     CVE-2013-0343     The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly     handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a     denial of service (excessive retries and address-generation outage), and consequently obtain sensitive     information, via ICMPv6 Router Advertisement (RA) messages.
     CVE-2013-4299      Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows     remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a     snapshot block device.
     CVE-2013-4345      Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper management of the state of the consumed data.
     CVE-2013-4368     The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment     override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain     sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a     segment register.
     CVE-2013-4355      Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain     hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations     related to addresses without associated memory.
     CVE-2013-4494     Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same     order, which allows local guest administrators with access to multiple vcpus to cause a denial of service     (host deadlock) via unspecified vectors.
     CVE-2013-2929     The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users     to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a     crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.
     CVE-2013-4483      The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a     reference count, which allows local users to cause a denial of service (memory consumption or system     crash) via a crafted application.
     CVE-2013-4554      Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not     properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted     application running in ring 1 or 2.
     CVE-2013-6381     Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel     through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact     via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.
     CVE-2013-6383     The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not     require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via     a crafted ioctl call.
     CVE-2013-6885      The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between     locked instructions and write-combined memory types, which allows local users to cause a denial of service     (system hang) via a crafted application, aka the errata 793 issue.
     CVE-2013-7263     The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data     structures have been initialized, which allows local users to obtain sensitive information from kernel     stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c,     net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
    Fixed bugs:
     Re-ordered the tasks in the RPC wait queue to fix a race condition between the rpc_wake_up_task() and     rpc_wake_up_status() functions introduced by a recent modification to the sunrpc code.
     Previously, running a background process on a GFS2 file system could trigger a glock recursion error     leading to a kernel panic. This has been fixed and readpage operations do not attempt to take a glock that     was already held any longer.
     Fixed a kernel panic that happened when the kernel dereferenced a NULL pointer; this was due to an     incomplete backport to the IUCV code.
     Previously, GFS2 prevented glock work queues from freeing glock-related memory while the glock memory     shrinker queued a large number of demote requests. Because of this bug, glock work queues became     overloaded and resulted in a high CPU usage rendering GFS2 file systems unresponsive for a while. This has     been partially fixed: this still happens but only on extremely high work loads.
     With the recent addition of the NT LAN Manager Security Support Provider (NTLMSSP) authentication     mechanism, a regression was introduced resulting in the impossibility to mount multiple SMB shares with     different credentials to the same server. This has been fixed.
     The igb driver now uses a a 32-bit mask as expected, instead of the previous 16-bit mask that disrupted     the flow control a network device.
     Previously, when a kernel panic occurred on a system utilizing IPMI without Kdump being set up, it could     trigger a second kernel panic. This has been fixed.
    Enhancement:
     It is now possible to change the 60 seconds timeout for SCSI task management commands within the range     from 5 to 180 seconds: modify the lpfc_task_mgmt_tmo parameter for the lpfc driver.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002185 advisory.

    The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote     attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a     different vulnerability than CVE-2012-2663.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001974 advisory.

    The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote     attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a     different vulnerability than CVE-2012-2663.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix three security issues and two bugs are now available for Red Hat Enterprise Linux 5.9 Extended Update Support.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled TCP packets with both the SYN and FIN flags set. A remote attacker could use this flaw to consume an excessive amount of resources on the target system, potentially resulting in a denial of service. (CVE-2012-6638, Moderate)

Red Hat would like to thank Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738.

This update also fixes the following bugs :

* While under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario. (BZ#1096060)

* A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes this bug by limiting very large positive timeouts to the maximal supported value.
(BZ#1091831)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0433 advisory.

    - [virt] HID: memory corruption flaw drivers/usb/input/hid-core.c (Jacob Tanenbaum) [1032996 1032999]     {CVE-2013-2888}
    - [virt] HID: memory corruption flaw in drivers/hv/hid-core.c (Jacob Tanenbaum) [1032996 1032999]     {CVE-2013-2888}
    - [net] tcp: drop SYN+FIN messages (Jiri Pirko) [1066057 1066058] {CVE-2012-6638}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2014:0433 :

Updated kernel packages that fix two security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled TCP packets with both the SYN and FIN flags set. A remote attacker could use this flaw to consume an excessive amount of resources on the target system, potentially resulting in a denial of service. (CVE-2012-6638, Moderate)

* A flaw was found in the way the Linux kernel handled HID (Human Interface Device) reports with an out-of-bounds Report ID. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-2888, Moderate)

This update also fixes the following bugs :

* A previous change to the sunrpc code introduced a race condition between the rpc_wake_up_task() and rpc_wake_up_status() functions. A race between threads operating on these functions could result in a deadlock situation, subsequently triggering a 'soft lockup' event and rendering the system unresponsive. This problem has been fixed by re-ordering tasks in the RPC wait queue. (BZ#1073731)

* Running a process in the background on a GFS2 file system could sometimes trigger a glock recursion error that resulted in a kernel panic. This happened when a readpage operation attempted to take a glock that had already been held by another function. To prevent this error, GFS2 now verifies whether the glock is already held when performing the readpage operation. (BZ#1073953)

* A previous patch backport to the IUCV (Inter User Communication Vehicle) code was incomplete. Consequently, when establishing an IUCV connection, the kernel could, under certain circumstances, dereference a NULL pointer, resulting in a kernel panic. A patch has been applied to correct this problem by calling the proper function when removing IUCV paths. (BZ#1077045)

In addition, this update adds the following enhancement :

* The lpfc driver had a fixed timeout of 60 seconds for SCSI task management commands. With this update, the lpfc driver enables the user to set this timeout within the range from 5 to 180 seconds. The timeout can be changed by modifying the 'lpfc_task_mgmt_tmo' parameter for the lpfc driver. (BZ#1073123)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled TCP packets with both the SYN and FIN flags set. A remote attacker could use this flaw to consume an excessive amount of resources on the target system, potentially resulting in a denial of service. (CVE-2012-6638, Moderate)

* A flaw was found in the way the Linux kernel handled HID (Human Interface Device) reports with an out-of-bounds Report ID. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-2888, Moderate)

This update also fixes the following bugs :

* A previous change to the sunrpc code introduced a race condition between the rpc_wake_up_task() and rpc_wake_up_status() functions. A race between threads operating on these functions could result in a deadlock situation, subsequently triggering a 'soft lockup' event and rendering the system unresponsive. This problem has been fixed by re-ordering tasks in the RPC wait queue. (BZ#1073731)

* Running a process in the background on a GFS2 file system could sometimes trigger a glock recursion error that resulted in a kernel panic. This happened when a readpage operation attempted to take a glock that had already been held by another function. To prevent this error, GFS2 now verifies whether the glock is already held when performing the readpage operation. (BZ#1073953)

* A previous patch backport to the IUCV (Inter User Communication Vehicle) code was incomplete. Consequently, when establishing an IUCV connection, the kernel could, under certain circumstances, dereference a NULL pointer, resulting in a kernel panic. A patch has been applied to correct this problem by calling the proper function when removing IUCV paths. (BZ#1077045)

In addition, this update adds the following enhancement :

* The lpfc driver had a fixed timeout of 60 seconds for SCSI task management commands. With this update, the lpfc driver enables the user to set this timeout within the range from 5 to 180 seconds. The timeout can be changed by modifying the 'lpfc_task_mgmt_tmo' parameter for the lpfc driver. (BZ#1073123)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

- A flaw was found in the way the Linux kernel's TCP/IP     protocol suite implementation handled TCP packets with     both the SYN and FIN flags set. A remote attacker could     use this flaw to consume an excessive amount of     resources on the target system, potentially resulting in     a denial of service. (CVE-2012-6638, Moderate)

  - A flaw was found in the way the Linux kernel handled HID     (Human Interface Device) reports with an out-of-bounds     Report ID. An attacker with physical access to the     system could use this flaw to crash the system or,     potentially, escalate their privileges on the system.
    (CVE-2013-2888, Moderate)

This update also fixes the following bugs :

  - A previous change to the sunrpc code introduced a race     condition between the rpc_wake_up_task() and     rpc_wake_up_status() functions. A race between threads     operating on these functions could result in a deadlock     situation, subsequently triggering a 'soft lockup' event     and rendering the system unresponsive. This problem has     been fixed by re-ordering tasks in the RPC wait queue.

  - Running a process in the background on a GFS2 file     system could sometimes trigger a glock recursion error     that resulted in a kernel panic. This happened when a     readpage operation attempted to take a glock that had     already been held by another function. To prevent this     error, GFS2 now verifies whether the glock is already     held when performing the readpage operation.

  - A previous patch backport to the IUCV (Inter User     Communication Vehicle) code was incomplete.
    Consequently, when establishing an IUCV connection, the     kernel could, under certain circumstances, dereference a     NULL pointer, resulting in a kernel panic. A patch has     been applied to correct this problem by calling the     proper function when removing IUCV paths.

In addition, this update adds the following enhancement :

  - The lpfc driver had a fixed timeout of 60 seconds for     SCSI task management commands. With this update, the     lpfc driver enables the user to set this timeout within     the range from 5 to 180 seconds. The timeout can be     changed by modifying the 'lpfc_task_mgmt_tmo' parameter     for the lpfc driver.

The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Severity
291041	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000856)	Nessus	Unity Linux Local Security Checks	high
289145	MiracleLinux 3 : kernel-2.6.18-371.3.AXS3 (AXSA:2014-405:01)	Nessus	Miracle Linux Local Security Checks	medium
286826	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002185)	Nessus	Unity Linux Local Security Checks	high
286651	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001974)	Nessus	Unity Linux Local Security Checks	high
79031	RHEL 5 : kernel (RHSA-2014:0772)	Nessus	Red Hat Local Security Checks	high
78171	F5 Networks BIG-IP : Linux kernel tcp_rcv_state_process vulnerability (SOL15304)	Nessus	F5 Networks Local Security Checks	high
73721	Oracle Linux 5 : kernel (ELSA-2014-0433)	Nessus	Oracle Linux Local Security Checks	high
73720	Oracle Linux 5 : kernel (ELSA-2014-0433-1)	Nessus	Oracle Linux Local Security Checks	high
73712	CentOS 5 : kernel (CESA-2014:0433)	Nessus	CentOS Local Security Checks	high
73706	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20140424)	Nessus	Scientific Linux Local Security Checks	high
73705	RHEL 5 : kernel (RHSA-2014:0433)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2012-6638

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high