VMware product updates address Linux kernel vulnerabilities in TCP Selective Acknowledgement (SACK) (CVE-2019-11477, CVE-2019-11478)

1. Impacted Products

• AppDefense
• Container Service Extension
• Enterprise PKS
• Horizon DaaS
• Hybrid Cloud Extension
• Identity Manager
• Integrated OpenStack
• NSX for vSphere
• NSX-T Data Center
• Pulse Console
• SD-WAN Edge by VeloCloud
• SD-WAN Gateway by VeloCloud
• SD-WAN Orchestrator by VeloCloud
• Skyline Collector
• Unified Access Gateway
• vCenter Server Appliance
• vCloud Availability Appliance
• vCloud Director For Service Providers
• vCloud Usage Meter
• vRealize Automation
• vRealize Business for Cloud
• vRealize Code Stream
• vRealize Log Insight
• vRealize Network Insight
• vRealize Operations Manager
• vRealize Orchestrator Appliance
• vRealize Suite Lifecycle Manager
• vSphere Data Protection
• vSphere Integrated Containers
• vSphere Replication

2. Introduction

Several vulnerabilities in the Linux kernel implementation of TCP Selective Acknowledgement (SACK) have been disclosed. These issues may allow a malicious entity to execute a Denial of Service attack against affected products.

3. Linux kernel vulnerabilities in TCP Selective Acknowledgement (SACK) CVE-2019-11477, CVE-2019-11478

**Description: **
There are two uniquely identifiable vulnerabilities associated with the Linux kernel implementation of SACK:

• CVE-2019-11477 - SACK Panic - A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.
• CVE-2019-11478 - SACK Excess Resource Usage - a crafted sequence of SACKs will fragment the TCP retransmission queue, causing resource exhaustion. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.

Known Attack Vectors: **
A malicious actor must have network access to an affected system including the ability to send traffic with low MSS values to the target. Successful exploitation of these issues may cause the target system to crash or significantly degrade performance.
**
Resolution:
**
To remediate CVE-2019-11477 and CVE-2019-11478 update/upgrade to the versions listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ found below.
**
Workarounds:
**
Some VMware Virtual Appliances can workaround CVE-2019-11477 and CVE-2019-11478 by either disabling SACK or by modifying the built in firewall (if available) in the base OS of the product to drop incoming connections with a low MSS value. In-product workarounds (if available) have been enumerated in the ‘Workarounds’ column of the ‘Resolution Matrix’ found below.
**
Additional Documentations:
**
None.
**
Acknowledgements:
**
None.
**
Response Matrix: