ID

VAR-201906-1175

CVE

CVE-2019-11477

TITLE

Ubuntu Security Notice USN-4017-1

DESCRIPTION

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. ========================================================================= Ubuntu Security Notice USN-4017-1 June 17, 2019 linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: The system could be made to crash if it received specially crafted network traffic. (CVE-2019-11477) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: linux-image-5.0.0-1008-aws 5.0.0-1008.8 linux-image-5.0.0-1008-gcp 5.0.0-1008.8 linux-image-5.0.0-1008-kvm 5.0.0-1008.8 linux-image-5.0.0-1010-raspi2 5.0.0-1010.10 linux-image-5.0.0-1014-snapdragon 5.0.0-1014.14 linux-image-5.0.0-17-generic 5.0.0-17.18 linux-image-5.0.0-17-generic-lpae 5.0.0-17.18 linux-image-5.0.0-17-lowlatency 5.0.0-17.18 linux-image-aws 5.0.0.1008.8 linux-image-gcp 5.0.0.1008.8 linux-image-generic 5.0.0.17.18 linux-image-generic-lpae 5.0.0.17.18 linux-image-gke 5.0.0.1008.8 linux-image-kvm 5.0.0.1008.8 linux-image-lowlatency 5.0.0.17.18 linux-image-raspi2 5.0.0.1010.7 linux-image-snapdragon 5.0.0.1014.7 linux-image-virtual 5.0.0.17.18 Ubuntu 18.10: linux-image-4.18.0-1013-gcp 4.18.0-1013.14 linux-image-4.18.0-1014-kvm 4.18.0-1014.14 linux-image-4.18.0-1016-raspi2 4.18.0-1016.18 linux-image-4.18.0-1018-aws 4.18.0-1018.20 linux-image-4.18.0-1020-azure 4.18.0-1020.20 linux-image-4.18.0-22-generic 4.18.0-22.23 linux-image-4.18.0-22-generic-lpae 4.18.0-22.23 linux-image-4.18.0-22-lowlatency 4.18.0-22.23 linux-image-4.18.0-22-snapdragon 4.18.0-22.23 linux-image-aws 4.18.0.1018.18 linux-image-azure 4.18.0.1020.21 linux-image-gcp 4.18.0.1013.13 linux-image-generic 4.18.0.22.23 linux-image-generic-lpae 4.18.0.22.23 linux-image-gke 4.18.0.1013.13 linux-image-kvm 4.18.0.1014.14 linux-image-lowlatency 4.18.0.22.23 linux-image-raspi2 4.18.0.1016.13 linux-image-snapdragon 4.18.0.22.23 linux-image-virtual 4.18.0.22.23 Ubuntu 18.04 LTS: linux-image-4.15.0-1015-oracle 4.15.0-1015.17 linux-image-4.15.0-1034-gcp 4.15.0-1034.36 linux-image-4.15.0-1036-kvm 4.15.0-1036.36 linux-image-4.15.0-1038-raspi2 4.15.0-1038.40 linux-image-4.15.0-1041-aws 4.15.0-1041.43 linux-image-4.15.0-1043-oem 4.15.0-1043.48 linux-image-4.15.0-1055-snapdragon 4.15.0-1055.59 linux-image-4.15.0-52-generic 4.15.0-52.56 linux-image-4.15.0-52-generic-lpae 4.15.0-52.56 linux-image-4.15.0-52-lowlatency 4.15.0-52.56 linux-image-4.18.0-1020-azure 4.18.0-1020.20~18.04.1 linux-image-4.18.0-22-generic 4.18.0-22.23~18.04.1 linux-image-4.18.0-22-generic-lpae 4.18.0-22.23~18.04.1 linux-image-4.18.0-22-lowlatency 4.18.0-22.23~18.04.1 linux-image-4.18.0-22-snapdragon 4.18.0-22.23~18.04.1 linux-image-aws 4.15.0.1041.40 linux-image-azure 4.18.0.1020.19 linux-image-gcp 4.15.0.1034.36 linux-image-generic 4.15.0.52.54 linux-image-generic-hwe-18.04 4.18.0.22.72 linux-image-generic-lpae 4.15.0.52.54 linux-image-generic-lpae-hwe-18.04 4.18.0.22.72 linux-image-kvm 4.15.0.1036.36 linux-image-lowlatency 4.15.0.52.54 linux-image-lowlatency-hwe-18.04 4.18.0.22.72 linux-image-oem 4.15.0.1043.47 linux-image-oracle 4.15.0.1015.18 linux-image-raspi2 4.15.0.1038.36 linux-image-snapdragon 4.15.0.1055.58 linux-image-snapdragon-hwe-18.04 4.18.0.22.72 linux-image-virtual 4.15.0.52.54 linux-image-virtual-hwe-18.04 4.18.0.22.72 Ubuntu 16.04 LTS: linux-image-4.15.0-1015-oracle 4.15.0-1015.17~16.04.1 linux-image-4.15.0-1034-gcp 4.15.0-1034.36~16.04.1 linux-image-4.15.0-1041-aws 4.15.0-1041.43~16.04.1 linux-image-4.15.0-1047-azure 4.15.0-1047.51 linux-image-4.15.0-52-generic 4.15.0-52.56~16.04.1 linux-image-4.15.0-52-generic-lpae 4.15.0-52.56~16.04.1 linux-image-4.15.0-52-lowlatency 4.15.0-52.56~16.04.1 linux-image-4.4.0-1048-kvm 4.4.0-1048.55 linux-image-4.4.0-1085-aws 4.4.0-1085.96 linux-image-4.4.0-1111-raspi2 4.4.0-1111.120 linux-image-4.4.0-1115-snapdragon 4.4.0-1115.121 linux-image-4.4.0-151-generic 4.4.0-151.178 linux-image-4.4.0-151-generic-lpae 4.4.0-151.178 linux-image-4.4.0-151-lowlatency 4.4.0-151.178 linux-image-4.4.0-151-powerpc-e500mc 4.4.0-151.178 linux-image-4.4.0-151-powerpc-smp 4.4.0-151.178 linux-image-4.4.0-151-powerpc64-emb 4.4.0-151.178 linux-image-4.4.0-151-powerpc64-smp 4.4.0-151.178 linux-image-aws 4.4.0.1085.88 linux-image-aws-hwe 4.15.0.1041.41 linux-image-azure 4.15.0.1047.51 linux-image-gcp 4.15.0.1034.48 linux-image-generic 4.4.0.151.159 linux-image-generic-hwe-16.04 4.15.0.52.73 linux-image-generic-lpae 4.4.0.151.159 linux-image-generic-lpae-hwe-16.04 4.15.0.52.73 linux-image-gke 4.15.0.1034.48 linux-image-kvm 4.4.0.1048.48 linux-image-lowlatency 4.4.0.151.159 linux-image-lowlatency-hwe-16.04 4.15.0.52.73 linux-image-oem 4.15.0.52.73 linux-image-oracle 4.15.0.1015.9 linux-image-powerpc-e500mc 4.4.0.151.159 linux-image-powerpc-smp 4.4.0.151.159 linux-image-powerpc64-emb 4.4.0.151.159 linux-image-powerpc64-smp 4.4.0.151.159 linux-image-raspi2 4.4.0.1111.111 linux-image-snapdragon 4.4.0.1115.107 linux-image-virtual 4.4.0.151.159 linux-image-virtual-hwe-16.04 4.15.0.52.73 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. # Advisory ###### ID: NFLX-2019-001 ###### Title: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service vulnerabilities ###### Release Date: 2019-06-17 ###### Severity: Critical ### Overview: Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. The vulnerabilities specifically relate to the minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. The most serious, dubbed _“SACK Panic_,” allows a remotely-triggered kernel panic on recent Linux kernels. There are patches that address most of these vulnerabilities. If patches can not be applied, certain mitigations will be effective. We recommend that affected parties enact one of those described below, based on their environment. __Fix:__ Apply the patch [PATCH_net_1_4.patch](2019-001/PATCH_net_1_4.patch). Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch [PATCH_net_1a.patch](2019-001/PATCH_net_1a.patch). __Workaround #1:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). __Workaround #2:__ Disable SACK processing (`/proc/sys/net/ipv4/tcp_sack` set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 2: [CVE-2019-11478](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11478): SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions) __Description:__ It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. __Fix:__ Apply the patch [PATCH_net_2_4.patch](2019-001/PATCH_net_2_4.patch) __Workaround #1:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). __Workaround #2:__ Disable SACK processing (`/proc/sys/net/ipv4/tcp_sack` set to 0). (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 3: [CVE-2019-5599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599): SACK Slowness (FreeBSD 12 using the RACK TCP Stack) __Description:__ It is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. __Workaround #1:__ Apply the patch [split_limit.patch](2019-001/split_limit.patch) and set the `net.inet.tcp.rack.split_limit` sysctl to a reasonable value to limit the size of the SACK table. __Workaround #2:__ Temporarily disable the RACK TCP stack. (Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.) ### 4: [CVE-2019-11479](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11479): Excess Resource Consumption Due to Low MSS Values (all Linux versions) __Description:__ An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic. __Fix:__ Two patches [PATCH_net_3_4.patch](2019-001/PATCH_net_3_4.patch) and [PATCH_net_4_4.patch](2019-001/PATCH_net_4_4.patch) add a sysctl which enforces a minimum MSS, set by the `net.ipv4.tcp_min_snd_mss` sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications. __Workaround:__ Block connections with a low MSS using one of the supplied [filters](2019-001/block-low-mss/README.md). (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the `net.ipv4.tcp_mtu_probing` sysctl is set to 0, which appears to be the default value for that sysctl). ### Note: Good system and application coding and configuration practices (limiting write buffers to the necessary level, monitoring connection memory consumption via SO_MEMINFO, and aggressively closing misbehaving connections) can help to limit the impact of attacks against these kinds of vulnerabilities. ## Acknowledgments: Originally reported by Jonathan Looney. We thank Eric Dumazet for providing Linux fixes and support. We thank Bruce Curtis for providing the Linux filters. We thank Jonathan Lemon and Alexey Kodanev for helping to improve the Linux patches. We gratefully acknowledge the assistance of Tyler Hicks in testing fixes, refining the information about vulnerable versions, and providing assistance during the disclosure process. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2019:1489-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1489 Issue date: 2019-06-17 CVE Names: CVE-2019-3896 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 6.6) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.6) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS). (CVE-2019-11477) * kernel: Double free in lib/idr.c (CVE-2019-3896) * Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478) * Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * MDS mitigations not enabled on Intel Skylake CPUs (BZ#1713026) * [RHEL6] md_clear flag missing from /proc/cpuinfo (BZ#1713029) * RHEL6 kernel does not disable SMT with mds=full,nosmt (BZ#1713044) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1694812 - CVE-2019-3896 kernel: Double free in lib/idr.c 1719123 - CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service 1719128 - CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service 1719129 - CVE-2019-11479 Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service 6. Package List: Red Hat Enterprise Linux Server AUS (v. 6.6): Source: kernel-2.6.32-504.79.3.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-504.79.3.el6.noarch.rpm kernel-doc-2.6.32-504.79.3.el6.noarch.rpm kernel-firmware-2.6.32-504.79.3.el6.noarch.rpm x86_64: kernel-2.6.32-504.79.3.el6.x86_64.rpm kernel-debug-2.6.32-504.79.3.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm kernel-debug-devel-2.6.32-504.79.3.el6.x86_64.rpm kernel-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-504.79.3.el6.x86_64.rpm kernel-devel-2.6.32-504.79.3.el6.x86_64.rpm kernel-headers-2.6.32-504.79.3.el6.x86_64.rpm perf-2.6.32-504.79.3.el6.x86_64.rpm perf-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm python-perf-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.6): x86_64: kernel-debug-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm kernel-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-504.79.3.el6.x86_64.rpm perf-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm python-perf-2.6.32-504.79.3.el6.x86_64.rpm python-perf-debuginfo-2.6.32-504.79.3.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-3896 https://access.redhat.com/security/cve/CVE-2019-11477 https://access.redhat.com/security/cve/CVE-2019-11478 https://access.redhat.com/security/cve/CVE-2019-11479 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/tcpsack 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXQfqA9zjgjWX9erEAQjGFw/7BKcJDZ/BdMJ5Qeo3m5T1VceySn1DzCdD bz0itfNjGl1sBS3U2T1aJgA3kplTofQkfB8RsInDifSPfMU1p1vvFurwkPpEQuVF JQy5Gbs0Q/lhpR48uYAi1sqdJAtHWEfi+w9mj+r7mzphlqQT4E3jI09lqAn/a0dH aaX+L9BmctlAZTooed/SJGXa/hz0d+HoMZFza3ssuWDyQQQ0CfEP6LJX5VRU4w5i wKFf3emBM6UclrGeZ3QiWcRsRhHs7Wm5eseEcBNqhPScgSGtWrJ7VMAHTTtgqiFD s4MoaNkAxZPsAMZCY7UGHXq4dyHPWUKdUpgGJXNROqQiGLsg7ua8/WMbx0v0Hrnu qBXtE30GDtPWLl059JRKrPrgf6oCN6Xz21q+NeLK6nkoroRd2BMSJ7anwULsu/Sd rDvzYHDkbCsJ3jRLEuHofUNaxUwsbx3Itdi1y4rfea4c+DmURuPFHcWTKAPjkjj6 +CdaAgw94ffMySzlWbyO6rsLLjuIFo5lvTeS3ma214C0jHr/KjqyJq7uW90opyzS pIRC34/c/vFkOrZW7HzIX66DYWzYFtVt+YiWfzq1KJe32n9dTATJ9gV6YSlYr7JQ JkdME41caivBzoURJvAnjqgcmaur8anpxaztK3RbqPJmjBTbbvvEAaJ/GDg2kSJu 4C8+Jcbxj4Y\xbdTB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

overflow

EXPLOIT AVAILABILITY

EXTERNAL IDS

REFERENCES

CREDITS

Ubuntu

SOURCES

LAST UPDATE DATE

2025-10-20T02:34:30.900000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE