Denys Fedoryshchenko

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG MAX SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

The issue allows remote attackers to cause a denial of service by consuming kernel resources through a flood of SYN+FIN TCP packets. This is achieved by exploiting the `tcp rcv state process` function in `net/ipv4/tcp input.c`.

The issue is related to the ip expire function in the Linux kernel, which does not properly construct ICMP TIME EXCEEDED packets after a timeout. This allows remote attackers to cause a denial of service via crafted fragmented packets, resulting in an invalid pointer dereference.

The issue is related to insufficient input validation in the extensions/libxt tcp.c component of the iptables interface, which could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted packet. The vulnerability might allow remote attackers to bypass intended firewall restrictions via crafted TCP SYN+FIN packets in --syn rules.