F5 Networks BIG-IP : Linux SACK Slowness vulnerability (K26618426)

Jonathan Looney discovered that the TCP retransmission queue implementation in tcpfragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment SACK sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel...

F5 Networks BIG-IP : Linux SACK Panic vulnerability (K78234183)

Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments SACKs. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182,...

The vulnerability of the tcp_sack_option() function in the kernel of the OpenBSD operating system allows a hacker to cause a service failure.

The vulnerability of the tcpsackoption function in the kernel of the OpenBSD operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2019-8460

OpenBSD kernel version = 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption for every incoming SACK packet which can lead to a denial of service...

CVE-2019-8460

OpenBSD kernel version = 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption for every incoming SACK packet which can lead to a denial of service...

Code injection

OpenBSD kernel version = 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption for every incoming SACK packet which can lead to a denial of service...

CVE-2019-8460

OpenBSD kernel version = 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption for every incoming SACK packet which can lead to a denial of service...

CVE-2019-8460: Excessive Data Query Operations in a Large Data Table

OpenBSD kernel version = 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption for every incoming SACK packet which can lead to a denial of service...

Important kernel security update: Virtuozzo ReadyKernel patch 85.0 for Virtuozzo 7.0.7 to 7.0.10 HF1 and Virtuozzo Infrastructure Platform 2.5

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to the kernels 3.10.0-693.17.1.vz7.43.10 Virtuozzo 7.0.7, 3.10.0-693.21.1.vz7.46.7 Virtuozzo 7.0.7 HF2, 3.10.0-693.21.1.vz7.48.2 Virtuozzo 7.0.7 HF3, 3.10.0-862.9.1.vz7.63.3 Virtuozzo 7.0.8...

NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0168)

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities: - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While processing SAC...

NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0165)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel-rt packages installed that are affected by multiple vulnerabilities: - Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0162)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While...

NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0165)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel packages installed that are affected by multiple vulnerabilities: - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0162)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1948-1) (SACK Panic) (SACK Slowness)

This update for the Linux Kernel 4.4.121-92104 fixes several issues. The following security issues were fixed : CVE-2019-11477: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow when handling TCP Selective Acknowledgments SACKs. A remote attacker...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1935-1) (SACK Slowness)

This update for the Linux Kernel 3.12.74-6064115 fixes one issue. The following security issue was fixed : This update contains a regression fix for CVE-2019-11478 bsc1140747. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1924-1) (SACK Panic) (SACK Slowness)

This update for the Linux Kernel 3.12.74-6064104 fixes several issues. The following security issues were fixed : CVE-2019-11477: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow when handling TCP Selective Acknowledgments SACKs. A remote attacke...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1870-1) (SACK Slowness)

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (SACK Panic) (SACK Slowness)

Based on the RPM metadata this appears to be a security kernel. The RPM changelog shows fixes related to Security Fixes : - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While processing SACK segments, t...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1855-1) (SACK Slowness)

The SUSE Linux Enterprise 15 kernel version 4.12.14 was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-10638: Attackers used to be able to track the Linux kernel by the IP ID values the kernel produces for connection-less protocols. When such...