[OE-core][PATCH v2 01/10] cve-exclusion: set status for CVE-2019-14899

[Junjie Cao <junjie.cao@linux.dev>]

A network-adjacent attacker can send packets addressed to a host's VPN
tunnel address over the physical interface. Because Linux uses the weak
host model by default, the host replies, which lets the attacker infer
the tunnel address, confirm active connections and eventually inject
into the tunneled TCP stream.

No kernel fix exists. The original disclosure states that reverse path
filtering is not a solution because the attack also works over IPv6,
which has no rp_filter at all:

  https://www.openwall.com/lists/oss-security/2019/12/05/1

Kernel-level mitigations were discussed on netdev and the WireGuard list
in December 2019 but nothing was merged; the mitigation that shipped was
a firewall rule added to wg-quick(8) in userspace:

  https://lore.kernel.org/all/20191205191318.GA44156@zx2c4.com/

Ubuntu has the issue deferred for every release since 2019-12-13 and
records "No current fix from upstream":

  https://ubuntu.com/security/CVE-2019-14899

Debian does not track it against the kernel source package at all, and
Red Hat scopes it to openvpn rather than the kernel:

  https://security-tracker.debian.org/tracker/CVE-2019-14899
  https://access.redhat.com/security/cve/CVE-2019-14899

The NVD entry carries an unversioned linux_kernel CPE, so no fixed
version can ever match it.

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
changes in v2:
- split out of the single combined patch, one CVE per patch as requested
- added primary source links (disclosures, distribution trackers, mailing
  list threads, upstream commits) to every commit message
- added the three CVEs with no upstream fix as "unpatched" entries instead
  of leaving them undocumented
- disclosed AI assistance per the contributor guide

v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index d27d7644..aaba26fe 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -192,3 +192,10 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18"
 # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3
 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906
 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
+
+# Consequence of the default weak host model, not a specific defect.
+# Mitigation is configuration only: rp_filter for IPv4, or a strong host
+# model rule such as the one wg-quick(8) installs, which also covers IPv6.
+# https://www.openwall.com/lists/oss-security/2019/12/05/1
+CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \
+host model, no kernel fix exists or is planned, mitigated by firewall configuration"
-- 
2.43.0