CanonicalCVELIST:CVE-2019-11478CVE-2019-11478 SACK can cause extensive memory use via fragmented resend queue
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
99.6%
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
CNA Affected
[
{
"product": "Linux kernel",
"vendor": "Linux",
"versions": [
{
"lessThan": "4.4.182",
"status": "affected",
"version": "4.4",
"versionType": "custom"
},
{
"lessThan": "4.9.182",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.14.127",
"status": "affected",
"version": "4.14",
"versionType": "custom"
},
{
"lessThan": "4.19.52",
"status": "affected",
"version": "4.19",
"versionType": "custom"
},
{
"lessThan": "5.1.11",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
}
]References
packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html
packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html
packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt
www.openwall.com/lists/oss-security/2019/06/28/2
www.openwall.com/lists/oss-security/2019/07/06/3
www.openwall.com/lists/oss-security/2019/07/06/4
www.openwall.com/lists/oss-security/2019/10/24/1
www.openwall.com/lists/oss-security/2019/10/29/3
www.vmware.com/security/advisories/VMSA-2019-0010.html
access.redhat.com/errata/RHSA-2019:1594
access.redhat.com/errata/RHSA-2019:1602
access.redhat.com/errata/RHSA-2019:1699
access.redhat.com/security/vulnerabilities/tcpsack
cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf
git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e
github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193
kc.mcafee.com/corporate/index?page=content&id=SB10287
psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007
seclists.org/bugtraq/2019/Jul/30
security.netapp.com/advisory/ntap-20190625-0001/
support.f5.com/csp/article/K26618426
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic
www.kb.cert.org/vuls/id/905115
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpuoct2020.html
www.synology.com/security/advisory/Synology_SA_19_28
www.us-cert.gov/ics/advisories/icsa-19-253-03
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
99.6%