K35421172 : Excess resource consumption due to low MSS values vulnerability CVE-2019-11479

Security Advisory Description

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. (CVE-2019-11479)

The Linux kernel is vulnerable to a flaw that allows attackers sending crafted packets with low maximum segment size (MSS) values to trigger excessive resource consumption.

Impact

BIG-IP

The BIG-IP system has no exposure to this vulnerability within the Traffic Management Microkernel (TMM), including virtual servers and virtual IP addresses (also known as the data plane). However, the BIG-IP system is vulnerable via the self IP addresses and the management interface (also known as the control plane). A remote attacker can exploit this vulnerability to cause a denial of service (DoS) by sending a sequence of specially crafted TCP packets.

Backend systems accessed via a FastL4 virtual server

By its nature as a full-proxy, the BIG-IP system protects backend systems accessed through a standard virtual server, as any attacker’s TCP connection would be terminated at the BIG-IP system. However, backend systems accessed via a FastL4 virtual server (a virtual server configured with a FastL4 profile) are exposed by default as the attack traffic is forwarded as-is to the backend system.

Traffix SDC

A remote attacker can exploit this vulnerability to cause a DoS by sending a sequence of specially crafted TCP packets.