ID

VAR-201906-1174

CVE

CVE-2019-11479

TITLE

Linux Kernel Vulnerable to resource exhaustion

DESCRIPTION

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. Linux Kernel Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. This vulnerability stems from improper management of system resources (such as memory, disk space, files, etc.) by network systems or products. A successful exploit could cause the targeted system to crash, resulting in a DoS condition. Proof-of-concept (PoC) code that demonstrates an exploit of this vulnerability is publicly available. Kernel.org has confirmed the vulnerability and released software updates. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Bug Fix(es): * [HPE 8.0 Bug] nvme drive power button does not turn off drive (BZ#1700288) * RHEL8.0 - hw csum failure seen in dmesg and console (using mlx5/mlx4/Mellanox) (BZ#1700289) * RHEL8.0 - vfio-ap: add subsystem to matrix device to avoid libudev failures (kvm) (BZ#1700290) * [FJ8.1 Bug]: Make Fujitsu Erratum 010001 patch work on A64FX v1r0 (BZ#1700901) * [FJ8.0 Bug]: Fujitsu A64FX processor errata - panic by unknown fault (BZ#1700902) * RHEL 8.0 Snapshot 4 - nvme create-ns command hangs after creating 20 namespaces on Bolt (NVMe) (BZ#1701140) * [Cavium/Marvell 8.0 qed] Fix qed_mcp_halt() and qed_mcp_resume() (backporting bug) (BZ#1704184) * [Intel 8.1 Bug] PBF: Base frequency display fix (BZ#1706739) * [RHEL8]read/write operation not permitted to /sys/kernel/debug/gcov/reset (BZ#1708100) * RHEL8.0 - ISST-LTE:pVM:fleetwood:LPM:raylp85:After lpm seeing the console logs on the the lpar at target side (BZ#1708102) * RHEL8.0 - Backport support for software count cache flush Spectre v2 mitigation (BZ#1708112) * [Regression] RHEL8.0 - System crashed with one stress-ng-mremap stressor on Boston (kvm host) (BZ#1708617) * [intel ice Rhel 8 RC1] ethtool -A ethx causes interfaces to go down (BZ#1709433) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2019:1485-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1485 Issue date: 2019-06-17 CVE Names: CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update Support, and Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.2) - noarch, x86_64 Red Hat Enterprise Linux Server E4S (v. 7.2) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.2) - x86_64 Red Hat Enterprise Linux Server Optional E4S (v. 7.2) - x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 7.2) - x86_64 Red Hat Enterprise Linux Server TUS (v. 7.2) - noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS). (CVE-2019-11477) * Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478) * Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * THP: Race between MADV_DONTNEED and NUMA hinting node migration code (BZ#1698103) * [RHEL7] md_clear flag missing from /proc/cpuinfo on late microcode update (BZ#1712989) * [RHEL7] MDS mitigations are not enabled after double microcode update (BZ#1712994) * WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:90 __static_key_slow_dec+0xa6/0xb0 (BZ#1713000) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1719123 - CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service 1719128 - CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service 1719129 - CVE-2019-11479 Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.2): Source: kernel-3.10.0-327.79.2.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.79.2.el7.noarch.rpm kernel-doc-3.10.0-327.79.2.el7.noarch.rpm x86_64: kernel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-headers-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.79.2.el7.x86_64.rpm perf-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.2): Source: kernel-3.10.0-327.79.2.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.79.2.el7.noarch.rpm kernel-doc-3.10.0-327.79.2.el7.noarch.rpm x86_64: kernel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-headers-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.79.2.el7.x86_64.rpm perf-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.2): Source: kernel-3.10.0-327.79.2.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-327.79.2.el7.noarch.rpm kernel-doc-3.10.0-327.79.2.el7.noarch.rpm x86_64: kernel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debug-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-devel-3.10.0-327.79.2.el7.x86_64.rpm kernel-headers-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-3.10.0-327.79.2.el7.x86_64.rpm perf-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.2): x86_64: kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional E4S (v. 7.2): x86_64: kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 7.2): x86_64: kernel-debug-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-327.79.2.el7.x86_64.rpm perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm python-perf-debuginfo-3.10.0-327.79.2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-11477 https://access.redhat.com/security/cve/CVE-2019-11478 https://access.redhat.com/security/cve/CVE-2019-11479 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/tcpsack 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXQfrL9zjgjWX9erEAQh8Yw//XDYZhLE+6/G5jELh43MDCVjixj/y8u2b RaMA/eOCJcq1MXV9k5XDruAeZWoMUcCV3OvBi4NIdQ4GXNb0idp3HvXUbAn6yxjh ANslnVZO8XTYFEpxdSGJf2DLVS+uwe+bnfgQQ6BTFJCDEfOAHsPv/d+jZF3qe2Hm WdD//r+U26C23e6Mz9nu1+k3fyScj+UCYCeIWLikKzboB5TmH1KDH7DS0p71JPKE 65I6b7W1ucj0SdvTpQH7VUesww+TM7KZHHwgo0Ydqusf+RoVyYbW3jbZGb+5m5aB tb8v/zaGsXBthKZmH6LCu02P+0Jbou8vEvqCztuwmqDocAeblm3mzeL8FerKCxCp obEEUcjsTbP+RDkNp2qjlfR6V11msl9PzTHXzrQw+7qxZodE9Jhv8Tvm3uTPvbi6 OTD9ez1Hkw5yaWIJBEitGLMxl4HjHaSXOLwbWkoQcEsv1ENmKtvz6wz64zefxljX VBPkLVuLGdwOzOlXHa9Oks3bWiKYUHt36R5sdz+uYL6NTCL5CLv8oUXCN5bYWRlU lCA6f5EYCR3Em8VFChAA51f+i688hmxq4sJwNtvoMVG96FwtVgSmmikb8cFN9+C+ qLlmaaC+b8cZ9COWfw2XAMkrFCYUNt7eL4W/vlZK+GkiYUxEYFZnJAqLXOWFgVpe nLvixkiNDOA=rUVR -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host (4.3.4), redhat-virtualization-host (4.3.4). # Advisory ###### ID: NFLX-2019-001 ###### Title: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service vulnerabilities ###### Release Date: 2019-06-17 ###### Severity: Critical ### Overview: Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. The vulnerabilities specifically relate to the minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. The most serious, dubbed _“SACK Panic_,” allows a remotely-triggered kernel panic on recent Linux kernels. There are patches that address most of these vulnerabilities. If patches can not be applied, certain mitigations will be effective. We recommend that affected parties enact one of those described below, based on their environment. ### Details: #### 1: [CVE-2019-11477](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11477): SACK Panic (Linux >= 2.6.29) __Description:__ A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic. __Fix:__ Apply the patch [PATCH_net_1_4.patch](2019-001/PATCH_net_1_4.patch). Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch [PATCH_net_1a.patch](2019-001/PATCH_net_1a.patch). __Workaround #1:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). __Workaround #2:__ Disable SACK processing (`/proc/sys/net/ipv4/tcp_sack` set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 2: [CVE-2019-11478](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11478): SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions) __Description:__ It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. __Fix:__ Apply the patch [PATCH_net_2_4.patch](2019-001/PATCH_net_2_4.patch) __Workaround #1:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). __Workaround #2:__ Disable SACK processing (`/proc/sys/net/ipv4/tcp_sack` set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 3: [CVE-2019-5599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599): SACK Slowness (FreeBSD 12 using the RACK TCP Stack) __Description:__ It is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. __Workaround #1:__ Apply the patch [split_limit.patch](2019-001/split_limit.patch) and set the `net.inet.tcp.rack.split_limit` sysctl to a reasonable value to limit the size of the SACK table. __Workaround #2:__ Temporarily disable the RACK TCP stack. (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 4: [CVE-2019-11479](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11479): Excess Resource Consumption Due to Low MSS Values (all Linux versions) __Description:__ An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic. __Fix:__ Two patches [PATCH_net_3_4.patch](2019-001/PATCH_net_3_4.patch) and [PATCH_net_4_4.patch](2019-001/PATCH_net_4_4.patch) add a sysctl which enforces a minimum MSS, set by the `net.ipv4.tcp_min_snd_mss` sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications. __Workaround:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). ### Note: Good system and application coding and configuration practices (limiting write buffers to the necessary level, monitoring connection memory consumption via SO_MEMINFO, and aggressively closing misbehaving connections) can help to limit the impact of attacks against these kinds of vulnerabilities. ## Acknowledgments: Originally reported by Jonathan Looney. We thank Eric Dumazet for providing Linux fixes and support. We thank Bruce Curtis for providing the Linux filters. We thank Jonathan Lemon and Alexey Kodanev for helping to improve the Linux patches. We gratefully acknowledge the assistance of Tyler Hicks in testing fixes, refining the information about vulnerable versions, and providing assistance during the disclosure process. 6.6) - x86_64 3. Bug Fix(es): * MDS mitigations not enabled on Intel Skylake CPUs (BZ#1713026) * [RHEL6] md_clear flag missing from /proc/cpuinfo (BZ#1713029) * RHEL6 kernel does not disable SMT with mds=full,nosmt (BZ#1713044) 4

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-06-19T21:24:41.548000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE