Re: CVE Request -- kernel: tcp: drop SYN+FIN messages

[Florian Weimer <fw () deneb enyo de>]

* John Haxby:

> Recently we have a couple of queries relating to a Nessus "TCP/IP
> SYN+FIN Packet Filtering Weakness".   This has not been helped by the
> fact that [1] actually points (indrectly) to CVE-2002-2438 which is
> actually a SYN+RST problem.

Reading the discussion here,

  <http://comments.gmane.org/gmane.linux.network/213981>

it seems to me that this is just a performance optimization which
could be bypassed by using different flags, so I don't think there's a
vulnerability or fix here, except the general lack of source IP
address validation in IP networks.