Information: Linux Security Vulnerability (CVE-2019-11477 & CVE-2019-11478)

Serverhosting
Dear Customers,
in order to maintain the best level of security on your servers, we invite you to read the following security bulletins regarding vulnerabilities of some Linux and FreeBSD systems and to provide, if necessary, for the application of the updates.
 
1: CVE-2019-11477: SACK Panic (Linux >= 2.6.29) - CVSS di 7.5
Description: A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic.
Fix: Apply the patch PATCH_net_1_4.patch. Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch PATCH_net_1a.patch.
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)

2: CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions)

Description: It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Fix: Apply the patch PATCH_net_2_4.patch
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
 
References:
Please consider these vulnerabilities as high level.
 
 
If you have any questions feel free to contact our customer support.
Article ID: 4107, , Modified: 7/2/2019 at 2:41 PM

Was this article helpful?

Share this article

Translations

Czech (čeština)