Skip to main content

Linux and FreeBSD SACK DoS Vulnerabilities

Security researchers have disclosed four vulnerabilities in the TCP networking stacks of the Linux and FreeBSD operating system kernels.

Threat ID:
CC-3106
Category:
Threat Severity:
Low
Threat Vector:
Published:
19 June 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security researchers have disclosed four vulnerabilities in the TCP networking stacks of the Linux and FreeBSD operating system kernels.

Affected platforms

The following platforms are known to be affected:

Linux

Linux - All kernel versions
  • FreeBSD - Version 12 using the RACK TCP stack

Linux kernel

Threat details

They claim that an attacker could exploit these vulnerabilities to cause a denial-of-service (DoS) condition on an affected system.

Three of the vulnerabilities are a result of improper implementations of the TCP selective acknowledgements (SACK) capability, a mechanism that allows a receiver to inform the sender of missing segments in a data stream. The other vulnerability affects the maximum segment size (MSS) TCP parameter, which specifies the largest amount of data that can be contained within one segment.

The vulnerabilities are as follows:

  • CVE-2019-11477 SACK Panic - Under certain conditions, a sequence of specially crafted SACK messages can be sent such that they trigger an integer overflow, causing a fatal error resulting in a kernel panic.
  • CVE-2019-11478 & CVE-2019-5999 SACK Slowness - Specially crafted SACK messages can fragment the TCP retransmission queue on Linux systems or the recent acknowledgements (RACK) send map on FreeBSD systems. This fragmentation will cause the systems to induce a linked-list walk, consuming their resources until a failure condition is reached.
  • CVE-2019-11479 Excess resource consumption - Using specially crafted TCP segments, the system can be forced into using an artificially low MSS value. This results in the system needing far more packets, and hence bandwidth, to transmit the same amount of data and in turn consuming the systems resources.

For further information:

Remediation steps

Type Step

The latest versions of the Linux kernel have been updated to address these vulnerabilities, with the following vendors deploying new operating system versions containing these updates:

Organisation are encouraged to contact their relevant suppliers in order to apply any necessary updates and workarounds. Organisation unable to do this may consider applying the following third-party patches below, although these are not tested or verified by NHS Digital and organisations use them at their own risk:

Last edited: 14 February 2020 2:49 pm