CVE-2019-11477: Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

Published Jun 11, 2019
·
Updated

An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).

Other sources

An integer overflow issue was found in the way Linux kernel processes TCP Selective Acknowledgement(SACK) segments. While processing SACK segments, Linux kernel's socket buffer(SBK) data structure becomes fragmented. Each fragment is about TCP MSS bytes. To efficiently process SACK blocks, Linux combines multiple fragmented SKB into one. This merging of SKB results in the said integer overflow issue, as more number of segments exceed the 16bit width of 'TCPSKBCB(skb)->tcpgsosegs' parameter in tcpshiftedskb() routine.

A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with minimum value of TCP MSS, resulting in DoS.

Upstream patch: --------------- -> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff

Reference: ---------- -> https://www.ietf.org/rfc/rfc2018.txt -> http://vger.kernel.org/~davem/skbdata.html -> https://git.kernel.org/linus/832d11c5cd076abc0aa1eaf7be96c81d1a59ce41

— Red Hat

Jonathan Looney discovered that the TCPSKBCB(skb)->tcpgsosegs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.

Affected Software

146 affected componentsFixes available
redhat/kernel<0:2.6.32-754.15.3.el6
0:2.6.32-754.15.3.el6
redhat/kernel<0:2.6.32-431.95.3.el6
0:2.6.32-431.95.3.el6
redhat/kernel<0:2.6.32-504.79.3.el6
0:2.6.32-504.79.3.el6
redhat/kernel-rt<0:3.10.0-957.21.3.rt56.935.el7
0:3.10.0-957.21.3.rt56.935.el7
redhat/kernel<0:3.10.0-957.21.3.el7
0:3.10.0-957.21.3.el7
redhat/kernel-alt<0:4.14.0-115.8.2.el7a
0:4.14.0-115.8.2.el7a
redhat/kernel<0:3.10.0-327.79.2.el7
0:3.10.0-327.79.2.el7
redhat/kernel<0:3.10.0-514.66.2.el7
0:3.10.0-514.66.2.el7
redhat/kernel<0:3.10.0-693.50.3.el7
0:3.10.0-693.50.3.el7
redhat/kernel<0:3.10.0-862.34.2.el7
0:3.10.0-862.34.2.el7
redhat/kernel-rt<0:4.18.0-80.4.2.rt9.152.el8_0
0:4.18.0-80.4.2.rt9.152.el8_0
redhat/kernel<0:4.18.0-80.4.2.el8_0
0:4.18.0-80.4.2.el8_0
redhat/kernel-rt<1:3.10.0-693.50.3.rt56.644.el6
1:3.10.0-693.50.3.rt56.644.el6
redhat/redhat-release-virtualization-host<0:4.2-11.1.el7
0:4.2-11.1.el7
redhat/redhat-virtualization-host<0:4.2-20190618.0.el7_6
0:4.2-20190618.0.el7_6
redhat/redhat-release-virtualization-host<0:4.3.4-1.el7e
0:4.3.4-1.el7e
redhat/redhat-virtualization-host<0:4.3.4-20190620.3.el7_6
0:4.3.4-20190620.3.el7_6
Linux Linux kernel>=2.6.29<3.16.69
Linux Linux kernel>=3.17<4.4.182
Linux Linux kernel>=4.5<4.9.182
Linux Linux kernel>=4.10<4.14.127
Linux Linux kernel>=4.15<4.19.52
Linux Linux kernel>=4.20<5.1.11
F5 BIG-IP Advanced Firewall Manager>=11.5.2<=11.6.4
F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.4
F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.1
F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.1.0
F5 BIG-IP Advanced Firewall Manager=15.0.0
F5 BIG-IP Access Policy Manager>=11.5.2<=11.6.4
F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.4
F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.1
F5 BIG-IP Access Policy Manager>=14.0.0<=14.1.0
F5 BIG-IP Access Policy Manager=15.0.0
F5 Big-ip Application Acceleration Manager>=11.5.2<=11.6.4
F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.4
F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.1
F5 Big-ip Application Acceleration Manager>=14.0.0<=14.1.0
F5 Big-ip Application Acceleration Manager=15.0.0
F5 Big-ip Link Controller>=11.5.2<=11.6.4
F5 Big-ip Link Controller>=12.1.0<=12.1.4
F5 Big-ip Link Controller>=13.1.0<=13.1.1
F5 Big-ip Link Controller>=14.0.0<=14.1.0
F5 Big-ip Link Controller=15.0.0
F5 Big-ip Policy Enforcement Manager>=11.5.2<=11.6.4
F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.4
F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.1
F5 Big-ip Policy Enforcement Manager>=14.0.0<=14.1.0
F5 Big-ip Policy Enforcement Manager=15.0.0
F5 Big-ip Webaccelerator>=11.5.2<=11.6.4
F5 Big-ip Webaccelerator>=12.1.0<=12.1.4
F5 Big-ip Webaccelerator>=13.1.0<=13.1.1
F5 Big-ip Webaccelerator>=14.0.0<=14.1.0
F5 Big-ip Webaccelerator=15.0.0
F5 BIG-IP Application Security Manager>=11.5.2<=11.6.4
F5 BIG-IP Application Security Manager>=12.1.0<=12.1.4
F5 BIG-IP Application Security Manager>=13.1.0<=13.1.1
F5 BIG-IP Application Security Manager>=14.0.0<=14.1.0
F5 BIG-IP Application Security Manager=15.0.0
F5 Big-ip Local Traffic Manager>=11.5.2<=11.6.4
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.1
F5 Big-ip Local Traffic Manager>=14.0.0<=14.1.0
F5 Big-ip Local Traffic Manager=15.0.0
F5 Big-ip Fraud Protection Service>=11.5.2<=11.6.4
F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.4
F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.1
F5 Big-ip Fraud Protection Service>=14.0.0<=14.1.0
F5 Big-ip Fraud Protection Service=15.0.0
F5 Big-ip Global Traffic Manager>=11.5.2<=11.6.4
F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.4
F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.1
F5 Big-ip Global Traffic Manager>=14.0.0<=14.1.0
F5 Big-ip Global Traffic Manager=15.0.0
F5 BIG-IP Analytics>=11.5.2<=11.6.4
F5 BIG-IP Analytics>=12.1.0<=12.1.4
F5 BIG-IP Analytics>=13.1.0<=13.1.1
F5 BIG-IP Analytics>=14.0.0<=14.1.0
F5 BIG-IP Analytics=15.0.0
F5 BIG-IP Edge Gateway>=11.5.2<=11.6.4
F5 BIG-IP Edge Gateway>=12.1.0<=12.1.4
F5 BIG-IP Edge Gateway>=13.1.0<=13.1.1
F5 BIG-IP Edge Gateway>=14.0.0<=14.1.0
F5 BIG-IP Edge Gateway=15.0.0
F5 Big-ip Domain Name System>=11.5.2<=11.6.4
F5 Big-ip Domain Name System>=12.1.0<=12.1.4
F5 Big-ip Domain Name System>=13.1.0<=13.1.1
F5 Big-ip Domain Name System>=14.0.0<=14.1.0
F5 Big-ip Domain Name System=15.0.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Canonical Ubuntu Linux=19.04
redhat Enterprise Linux Atomic Host
redhat Enterprise Linux=5.0
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux Aus=6.5
redhat Enterprise Linux Aus=6.6
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise MRG=2.0
Ivanti Connect Secure
PulseSecure Pulse Policy Secure
PulseSecure Pulse Secure Virtual Application Delivery Controller
F5 Traffix Signaling Delivery Controller>=5.0.0<=5.1.0
PulseSecure Pulse Connect Secure
Siemens CloudConnect 712<1.1.5
1.1.5
Siemens ROX II<2.13.3
2.13.3
Siemens RUGGEDCOM APE 1404 Linux: All versions prior to Debian 9 Linux Image 2019-12-13
Siemens RUGGEDCOM RM1224 (6GK6108-4AM00)<6.2
6.2
Siemens RUGGEDCOM RX 1400 VPE Debian Linux: All versions prior to Debian 9 Linux Image 2019-12-13
Siemens RUGGEDCOM RX 1400 VPE Linux CloudConnect: All versions prior to Debian 9 Linux Image 2019-12-13 13 (only affected by CVE-2019-11479)
Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2)<6.2
6.2
Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2)<6.2
6.2
Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2)<6.2
6.2
Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2)<6.2
6.2
Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2)<6.2
6.2
Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)<6.2
6.2
Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2)<6.2
6.2
Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2)<6.2
6.2
Siemens SCALANCE M875
Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2)<6.2
6.2
Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)<6.2
6.2
Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)<6.2
6.2
Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)<6.2
6.2
Siemens SCALANCE S602<4.1
4.1
Siemens SCALANCE S612<4.1
4.1
Siemens SCALANCE S615 (6GK5615-0AA00-2AA2)<6.2
6.2
Siemens SCALANCE S623<4.1
4.1
Siemens SCALANCE S627-2M<4.1
4.1
Siemens SCALANCE SC622-2C (6GK5622-2GS00-2AC2)<2.0.1
2.0.1
Siemens SCALANCE SC632-2C (6GK5632-2GS00-2AC2)<2.0.1
2.0.1
Siemens SCALANCE SC636-2C (6GK5636-2GS00-2AC2)<2.0.1
2.0.1
Siemens SCALANCE SC642-2C (6GK5642-2GS00-2AC2)<2.0.1
2.0.1
Siemens SCALANCE SC646-2C (6GK5646-2GS00-2AC2)<2.0.1
2.0.1
Siemens SCALANCE W1750D<8.6.0
8.6.0
Siemens SCALANCE W-700 IEEE 802.11n family<6.4
6.4
Siemens SCALANCE W-1700 IEEE 802.11ac family<2.0
2.0
Siemens SCALANCE WLC711
Siemens SCALANCE WLC712
Siemens SIMATIC CM 1542-1<3.0
3.0
Siemens SIMATIC CP 343-1 Advanced (incl. SIPLUS variants)
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:2.6.32-754.15.3.el6
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:2.6.32-431.95.3.el6
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:2.6.32-504.79.3.el6
  4. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-957.21.3.rt56.935.el7
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-957.21.3.el7
  6. Upgrade

    Upgrade redhat/kernel-alt to a version that resolves this vulnerability.

    Fixed in 0:4.14.0-115.8.2.el7a
  7. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-327.79.2.el7
  8. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-514.66.2.el7
  9. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-693.50.3.el7
  10. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-862.34.2.el7
  11. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-80.4.2.rt9.152.el8_0
  12. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-80.4.2.el8_0
  13. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 1:3.10.0-693.50.3.rt56.644.el6
  14. Upgrade

    Upgrade redhat/redhat-release-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.2-11.1.el7
  15. Upgrade

    Upgrade redhat/redhat-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.2-20190618.0.el7_6
  16. Upgrade

    Upgrade redhat/redhat-release-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.3.4-1.el7e
  17. Upgrade

    Upgrade redhat/redhat-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.3.4-20190620.3.el7_6
  18. Upgrade

    Upgrade Siemens Simatic Cloud Connect 7 CC712 to a version that resolves this vulnerability.

    Fixed in 1.1.5
  19. Upgrade

    Upgrade Siemens ROX to a version that resolves this vulnerability.

    Fixed in 2.13.3
  20. Upgrade

    Upgrade Siemens RUGGEDCOM RM1224 to a version that resolves this vulnerability.

    Fixed in 6.2
  21. Upgrade

    Upgrade Siemens SCALANCE M804PB to a version that resolves this vulnerability.

    Fixed in 6.2
  22. Upgrade

    Upgrade Siemens Scalance M812-1 ADSL Router to a version that resolves this vulnerability.

    Fixed in 6.2
  23. Upgrade

    Upgrade Siemens Scalance M816-1 ADSL-Router Firmware to a version that resolves this vulnerability.

    Fixed in 6.2
  24. Upgrade

    Upgrade Siemens SCALANCE M826-2 SHDSL-Router to a version that resolves this vulnerability.

    Fixed in 6.2
  25. Upgrade

    Upgrade Siemens SCALANCE M874-2 to a version that resolves this vulnerability.

    Fixed in 6.2
  26. Upgrade

    Upgrade Siemens SCALANCE M874-3 to a version that resolves this vulnerability.

    Fixed in 6.2
  27. Upgrade

    Upgrade Siemens SCALANCE M876-3 to a version that resolves this vulnerability.

    Fixed in 6.2
  28. Upgrade

    Upgrade Siemens SCALANCE M876-4 to a version that resolves this vulnerability.

    Fixed in 6.2
  29. Upgrade

    Upgrade Siemens Scalance S602 Firmware to a version that resolves this vulnerability.

    Fixed in 4.1
  30. Upgrade

    Upgrade Siemens Scalance S612 Firmware to a version that resolves this vulnerability.

    Fixed in 4.1
  31. Upgrade

    Upgrade Siemens SCALANCE S615 to a version that resolves this vulnerability.

    Fixed in 6.2
  32. Upgrade

    Upgrade Siemens Scalance S623 Firmware to a version that resolves this vulnerability.

    Fixed in 4.1
  33. Upgrade

    Upgrade Siemens Scalance S627-2M Firmware to a version that resolves this vulnerability.

    Fixed in 4.1
  34. Upgrade

    Upgrade Siemens SCALANCE SC622-2C to a version that resolves this vulnerability.

    Fixed in 2.0.1
  35. Upgrade

    Upgrade Siemens SCALANCE SC632-2C to a version that resolves this vulnerability.

    Fixed in 2.0.1
  36. Upgrade

    Upgrade Siemens SCALANCE SC636-2C to a version that resolves this vulnerability.

    Fixed in 2.0.1
  37. Upgrade

    Upgrade Siemens SCALANCE SC642-2C to a version that resolves this vulnerability.

    Fixed in 2.0.1
  38. Upgrade

    Upgrade Siemens SCALANCE SC646-2C to a version that resolves this vulnerability.

    Fixed in 2.0.1
  39. Upgrade

    Upgrade Siemens Scalance W1750D Firmware to a version that resolves this vulnerability.

    Fixed in 8.6.0
  40. Upgrade

    Upgrade Siemens SCALANCE W-700 to a version that resolves this vulnerability.

    Fixed in 6.4
  41. Upgrade

    Upgrade Siemens SCALANCE W1700 IEEE 802.11ac to a version that resolves this vulnerability.

    Fixed in 2.0
  42. Upgrade

    Upgrade Siemens SIMATIC CM 1542-1 Firmware to a version that resolves this vulnerability.

    Fixed in 3.0
  43. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
  44. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.4.182
  45. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.9.182
  46. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.14.127
  47. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 4.19.52
  48. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 5.1.11

Event History

Jun 11, 2019
Data Sourced
via Red Hat·06:20 AM
DescriptionSeverityAffected Software
Jun 17, 2019
CVE Published
05:00 PM
Jun 18, 2019
CVE Published
via MITRE·11:34 PM
Data Sourced
via MITRE·11:34 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2019-11477?

CVE-2019-11477 has a high severity rating due to the potential for an integer overflow that could lead to denial of service or code execution.

2

How do I fix CVE-2019-11477?

To fix CVE-2019-11477, update your Linux kernel to the fixed versions provided by your distribution, such as those specified in Red Hat and Debian advisories.

3

Which versions of the Linux kernel are affected by CVE-2019-11477?

CVE-2019-11477 affects several Linux kernel versions, specifically versions prior to the vendor-specific patched releases.

4

What exploits are associated with CVE-2019-11477?

Exploits associated with CVE-2019-11477 may allow attackers to cause denial of service or potentially execute arbitrary code on affected systems.

5

Who is impacted by CVE-2019-11477?

Users running affected versions of the Linux kernel, especially on servers and devices utilizing TCP, should be aware of the vulnerability and take action to secure their systems.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203