Bug 1422081 (CVE-2017-5972) - CVE-2017-5972 kernel: SYN cookie protection mechanism not properly implemented
Summary: CVE-2017-5972 kernel: SYN cookie protection mechanism not properly implemented
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-5972
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1422084
TreeView+ depends on / blocked
 
Reported: 2017-02-14 12:41 UTC by Andrej Nemec
Modified: 2019-09-29 14:07 UTC (History)
42 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-02-05 00:07:27 UTC


Attachments (Terms of Use)

Description Andrej Nemec 2017-02-14 12:41:47 UTC
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets.

The belief is that the system spends considerable time generating TCP syn cookies and creates a soft lockup in the system, reducing its ability to handle other requests.  This is as the syn cookie generation is serialized per system and not per CPU.  Other CPU's on the system can continue to work correctly.

References:

https://cxsecurity.com/issue/WLB-2017020112
https://githubengineering.com/syn-flood-mitigation-with-synsanity/

Comment 2 Wade Mealing 2017-03-03 04:34:25 UTC
Statement:

This issue affects Red Hat Enterprise Linux 5,6, 7 and MRG-2 kernels.  Red Hat has no plans to fix this issue at this time.

While performance enhancements have been made upstream, Red Hat Product Security believes the report to be invalid and able to be mitigated with synproxy.  This flaw is currently under investigation for validity and Red Hat is asking to revoke the CVE.


Note You need to log in before you can comment on or make changes to this bug.