K03685068 : Linux kernel vulnerability CVE-2017-5972

Security Advisory Description

The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.(CVE-2017-5972)

Impact

In a default configuration, the BIG-IP system is not vulnerable. However, BIG-IP systems can be vulnerable when you disable the SYN cookie protection (the SYN cookie protection is enabled by default), and the self IP address has the ability to ingress more than 10G of traffic throughput.