CVE-2019-8460: High severity openbsd vulnerability
OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcpsackoption() for every incoming SACK packet which can lead to a denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-8460?
CVE-2019-8460 is a vulnerability in the OpenBSD kernel version <= 6.5 that allows an attacker to force the creation of long chains of TCP SACK holes, leading to a denial of service.
How severe is CVE-2019-8460?
CVE-2019-8460 has a severity rating of 7.5 (high).
Which version of OpenBSD is affected by CVE-2019-8460?
OpenBSD versions up to and including 6.5 are affected by CVE-2019-8460.
How can the CVE-2019-8460 vulnerability be exploited?
An attacker can exploit the CVE-2019-8460 vulnerability by forcing the OpenBSD kernel to create long chains of TCP SACK holes, causing expensive calls to tcp_sack_option() for every incoming SACK packet.
What is the recommended fix for CVE-2019-8460?
Applying the patch provided by OpenBSD is recommended to fix the CVE-2019-8460 vulnerability. The patch can be downloaded from the official OpenBSD website.