SACK TCP flaws can crash, slow down Linux-based systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11477 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Ackno Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. NVD description · AI analysis pending | 7.5 | 99% |
| — | ||
| CVE-2019-5599 | In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several li In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service. NVD description · AI analysis pending | 7.5 | 5% |
| — |
Full article304 words · extracted from helpnetsecurity.com · click to collapse
An engineering manager at Netflix has unearthed several TCP networking vulnerabilities in Linux and FreeBSD kernels that could lead to systems crashing or consuming too many resources and (consequently) slowing down.
About the vulnerabilities
The flaws were discovered by Jonathan Looney, who apart from working at Netflix is also a FreeBSD developer.
They all affect the Selective Acknowledgments (SACK) TCP mechanism, which allows a receiving machine to acknowledge which data/packets it has received so that the sending machine will only resend the missing data segments. The mechanism is aimed at speeding up the transfer of data between computers.
TCP SACK is enabled by default in Linux but it can be turned off to prevent excessive resource and bandwidth consumption (and a possible DoS condition) or the over-saturation of low-bandwith connections.
The vulnerabilities are as follows:
- CVE-2019-11477, aka SACK Panic. Affects Linux kernel version 2.6.29 and all later ones. This one could lead to kernel panic and DoS.
- CVE-2019-11478, aka SACK Slowness or Excess Resource Usage. The latter can be triggered in all Linux versions, while the former just on Linux kernels prior to version 4.15
- CVE-2019-11479, aka Excess Resource Consumption Due to Low MSS Values. Affects all Linux kernel versions.
- CVE-2019-5599, aka SACK Slowness. Affects FreeBSD 12 using the RACK TCP Stack (not enabled by default).
All of these have mitigations, workarounds and patches, which can be reviewed here.
The RedHat, Debian and SuSE development teams have already pushed out kernel patches solving the issues or provided temporary workarounds. AWS has already updated or plans to update the Linux kernel in several of its solutions in order to plug the holes.
Other organizations are sure to follow them shortly, so if you’re running a Linux-based system, be on the lookout for patches.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/06/18/linux-sack-tcp-flaws/