Bug 1719123 (CVE-2019-11477)

Summary: CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: acaringi, ahardin, airlied, a.klindt, asavkov, bfinger, bhu, blc, bleanhar, brdeoliv, bskeggs, ccoleman, dblechte, dedgar, dfediuck, dhoward, dvlasenk, eedri, esammons, fhrbata, fwestpha, hannsj_uhl, hdegoede, hkrzesin, iboverma, ichavero, igkioka, itamar, jarodwilson, jbenc, jeremy, jforbes, jglisse, jgoulding, jkacur, joe.lawrence, john.j5live, jonathan, josef, jpoimboe, jross, jstancek, jwboyer, kernel-maint, kernel-mgr, kgrant, labbott, lgoncalv, linville, matt, mchappel, mchehab, mcressma, mgoldboi, michal.skrivanek, mjg59, mlangsdo, mleitner, mmilgram, mszczewski, nhorman, nmurray, plougher, pmatouse, pmyers, ppandit, qguo, rkhan, rt-maint, rvrbovsk, sbonazzo, security-response-team, sherold, steved, williams, yjog, yturgema, z-yk
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:07:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1719584, 1719585, 1719586, 1719587, 1719588, 1719590, 1719591, 1719592, 1719593, 1719594, 1719595, 1719596, 1719597, 1719598, 1719599, 1719600, 1719601, 1719602, 1719603, 1719604, 1719605, 1719606, 1719607, 1720458, 1720692, 1720693, 1721057, 1721058, 1721059, 1721119, 1721254, 1726402, 1726403, 1726428    
Bug Blocks: 1719124, 1719214, 1719215, 1719216, 1719217, 1719218, 1719219    

Description Sam Fowler 2019-06-11 06:20:39 UTC 
An integer overflow issue was found in the way Linux kernel processes TCP 
Selective Acknowledgement(SACK) segments. While processing SACK segments, Linux 
kernel's socket buffer(SBK) data structure becomes fragmented. Each fragment is 
about TCP MSS bytes. To efficiently process SACK blocks, Linux combines multiple 
fragmented SKB into one. This merging of SKB results in the said integer overflow 
issue, as more number of segments exceed the 16bit width of 
'TCP_SKB_CB(skb)->tcp_gso_segs' parameter in tcp_shifted_skb() routine.

A remote attacker could use this flaw to crash the Linux kernel by sending a 
crafted sequence of SACK segments on a TCP connection with minimum value of TCP 
MSS, resulting in DoS.

Upstream patch:
---------------
  -> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff

Reference:
----------
  -> https://www.ietf.org/rfc/rfc2018.txt
  -> http://vger.kernel.org/~davem/skb_data.html
  -> https://git.kernel.org/linus/832d11c5cd076abc0aa1eaf7be96c81d1a59ce41
Comment 10 Prasad Pandit 2019-06-17 07:02:10 UTC 
Acknowledgments:

Name: Jonathan Looney (Netflix Information Security)
Comment 11 Petr Matousek 2019-06-17 08:33:18 UTC 
Statement:

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack
Comment 12 Petr Matousek 2019-06-17 08:33:21 UTC 
Mitigation:

For mitigation, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack
Comment 15 Petr Matousek 2019-06-17 17:21:50 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1721254]
Comment 17 Petr Matousek 2019-06-17 17:45:47 UTC 
External References:

https://www.openwall.com/lists/oss-security/2019/06/17/5
https://patchwork.ozlabs.org/project/netdev/list/?series=114310
Comment 18 errata-xmlrpc 2019-06-17 18:00:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1479 https://access.redhat.com/errata/RHSA-2019:1479
Comment 19 errata-xmlrpc 2019-06-17 18:24:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1488 https://access.redhat.com/errata/RHSA-2019:1488
Comment 20 errata-xmlrpc 2019-06-17 18:32:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1481 https://access.redhat.com/errata/RHSA-2019:1481
Comment 21 errata-xmlrpc 2019-06-17 19:06:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2019:1482 https://access.redhat.com/errata/RHSA-2019:1482
Comment 22 errata-xmlrpc 2019-06-17 19:09:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Extended Update Support

Via RHSA-2019:1483 https://access.redhat.com/errata/RHSA-2019:1483
Comment 23 errata-xmlrpc 2019-06-17 19:27:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support

Via RHSA-2019:1489 https://access.redhat.com/errata/RHSA-2019:1489
Comment 24 errata-xmlrpc 2019-06-17 19:29:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support

Via RHSA-2019:1490 https://access.redhat.com/errata/RHSA-2019:1490
Comment 25 errata-xmlrpc 2019-06-17 19:33:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support
  Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.2 Telco Extended Update Support

Via RHSA-2019:1485 https://access.redhat.com/errata/RHSA-2019:1485
Comment 26 errata-xmlrpc 2019-06-17 19:37:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2019:1484 https://access.redhat.com/errata/RHSA-2019:1484
Comment 27 errata-xmlrpc 2019-06-17 19:56:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1480 https://access.redhat.com/errata/RHSA-2019:1480
Comment 28 errata-xmlrpc 2019-06-17 19:56:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2019:1487 https://access.redhat.com/errata/RHSA-2019:1487
Comment 29 errata-xmlrpc 2019-06-17 19:59:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1486 https://access.redhat.com/errata/RHSA-2019:1486
Comment 32 errata-xmlrpc 2019-06-25 09:19:24 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1594 https://access.redhat.com/errata/RHSA-2019:1594
Comment 33 errata-xmlrpc 2019-06-25 18:07:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1602 https://access.redhat.com/errata/RHSA-2019:1602
Comment 34 Sam Fowler 2019-06-27 00:36:23 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4 (RH CoreOS)

Via RHBA-2019:1589 https://access.redhat.com/errata/RHBA-2019:1589
Comment 35 errata-xmlrpc 2019-07-08 09:18:55 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:1699 https://access.redhat.com/errata/RHSA-2019:1699
Comment 36 Product Security DevOps Team 2019-07-12 13:07:23 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11477
Comment 38 Sam Fowler 2020-05-18 06:36:30 UTC 
OpenShift Container Platform 4 does not ship its own kernel package, instead using versions shipped in RHEL. Removing from flaw bug affects.