CVE-2019-11479: High severity Linux Linux kernel vulnerability
Published Jun 11, 2019
·
Updated
An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS.
Other sources
An excessive resource consumption issue was found in the way
Linux kernel processes TCP segments. If Maximum Segment Size(MSS) of a TCP
connection was set to its lowest value of 48 bytes, it leaves merely 8 bytes for
the user data. It significantly increases Linux kernel's resource
(CPU/Memory/Bandwidth etc.) utilisation leading to a DoS like scenario.
A remote attacker could use this flaw to cause DoS by repeatedly sending network
traffic on a TCP connection with lowest value for TCP MSS.
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
This can be mitigated by dropping all packets which specify a too small
MSS value. For example, to only allow MSS values of greater than 500
bytes, an iptables rule can be specified as:
sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP
Note: this will only take effect if the net.ipv4.tcp_mtu_probing sysctl is
disabled as well.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.