CVE-2019-11478: SACK can cause extensive memory use via fragmented resend queue
Published Jun 11, 2019
·
Updated
An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection.
Other sources
An excessive resource(CPU/Memory etc.) consumption issue was found in the way
Linux kernel processes TCP Selective Acknowledgement(SACK) segments. While
processing SACK segments, Linux kernel's socket buffer(SBK) data structure
becomes fragmented. SKB is also used as retransmission queue. This fragmentation
leads to increased resource utilisation to traverse and process these fragments,
as further SACK segments are received on the same TCP connection.
A remote attacker could use this flaw to cause a DoS by sending a crafted
sequence of SACK segments on a TCP connection.
Jonathan Looney discovered that the TCP retransmission queue implementation in tcpfragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.