Bug 1719128 (CVE-2019-11478) - CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service
Summary: CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing S...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11478
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1719839 1719841 1719844 1721063 1719608 1719609 1719610 1719611 1719612 1719664 1719665 1719840 1719842 1719843 1719845 1719846 1719847 1719848 1719849 1719850 1719851 1719852 1719853 1719854 1719855 1719856 1719857 1719858 1719860 1719861 1719863 1721061 1721062 1721121 1721256
Blocks: 1719124
TreeView+ depends on / blocked
 
Reported: 2019-06-11 06:36 UTC by Sam Fowler
Modified: 2019-10-02 11:41 UTC (History)
71 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:07:26 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1479 None None None 2019-06-17 18:00:08 UTC
Red Hat Product Errata RHSA-2019:1480 None None None 2019-06-17 19:56:15 UTC
Red Hat Product Errata RHSA-2019:1481 None None None 2019-06-17 18:32:10 UTC
Red Hat Product Errata RHSA-2019:1482 None None None 2019-06-17 19:06:30 UTC
Red Hat Product Errata RHSA-2019:1483 None None None 2019-06-17 19:09:13 UTC
Red Hat Product Errata RHSA-2019:1484 None None None 2019-06-17 19:37:48 UTC
Red Hat Product Errata RHSA-2019:1485 None None None 2019-06-17 19:33:15 UTC
Red Hat Product Errata RHSA-2019:1486 None None None 2019-06-17 19:59:16 UTC
Red Hat Product Errata RHSA-2019:1487 None None None 2019-06-17 19:56:42 UTC
Red Hat Product Errata RHSA-2019:1488 None None None 2019-06-17 18:24:25 UTC
Red Hat Product Errata RHSA-2019:1489 None None None 2019-06-17 19:28:09 UTC
Red Hat Product Errata RHSA-2019:1490 None None None 2019-06-17 19:29:06 UTC
Red Hat Product Errata RHSA-2019:1594 None None None 2019-06-25 09:19:27 UTC
Red Hat Product Errata RHSA-2019:1602 None None None 2019-06-25 18:07:49 UTC
Red Hat Product Errata RHSA-2019:1699 None None None 2019-07-08 09:19:02 UTC

Description Sam Fowler 2019-06-11 06:36:38 UTC
An excessive resource(CPU/Memory etc.) consumption issue was found in the way 
Linux kernel processes TCP Selective Acknowledgement(SACK) segments. While 
processing SACK segments, Linux  kernel's socket buffer(SBK) data structure 
becomes fragmented. SKB is also used as retransmission queue. This fragmentation 
leads to increased resource utilisation to traverse and process these fragments, 
as further SACK segments are received on the same TCP connection.

A remote attacker could use this flaw to cause a DoS by sending a crafted
sequence of SACK segments on a TCP connection.

Upstream patch:
---------------
  -> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e

Reference:
----------
  -> https://www.ietf.org/rfc/rfc2018.txt
  -> http://vger.kernel.org/~davem/skb_data.html

Comment 8 Prasad J Pandit 2019-06-17 07:03:55 UTC
Acknowledgments:

Name: Jonathan Looney (Netflix Information Security)

Comment 10 Petr Matousek 2019-06-17 08:58:25 UTC
Statement:

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Red Hat Enterprise Linux 5 is now in Maintenance Support 2 Phase of maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be  addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 11 Petr Matousek 2019-06-17 08:58:27 UTC
Mitigation:

For mitigation, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Comment 12 Prasad J Pandit 2019-06-17 09:46:27 UTC
Note:

This issue has been rated as having Moderate impact because the denial of service effect is caused by excessive resource(CPU/Memory/Bandwidth etc.) consumption by the offending TCP connections and thus temporary. It leaves lesser resources for the other processes and connections on the system.

This resource crunch lasts as long as the offending TCP connections are alive with incoming network traffic. It does not completely halt the system. Network monitoring system(s) would likely raise alerts/alarms for such incoming network traffic. So an administrator should be able to take due measures to thwart offending TCP connections and pertaining network traffic to control the impact of the DoS on affected systems.

Comment 14 Petr Matousek 2019-06-17 17:26:59 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1721256]

Comment 17 errata-xmlrpc 2019-06-17 18:00:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1479 https://access.redhat.com/errata/RHSA-2019:1479

Comment 18 errata-xmlrpc 2019-06-17 18:24:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1488 https://access.redhat.com/errata/RHSA-2019:1488

Comment 19 errata-xmlrpc 2019-06-17 18:32:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1481 https://access.redhat.com/errata/RHSA-2019:1481

Comment 20 errata-xmlrpc 2019-06-17 19:06:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2019:1482 https://access.redhat.com/errata/RHSA-2019:1482

Comment 21 errata-xmlrpc 2019-06-17 19:09:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Extended Update Support

Via RHSA-2019:1483 https://access.redhat.com/errata/RHSA-2019:1483

Comment 22 errata-xmlrpc 2019-06-17 19:28:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support

Via RHSA-2019:1489 https://access.redhat.com/errata/RHSA-2019:1489

Comment 23 errata-xmlrpc 2019-06-17 19:29:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support

Via RHSA-2019:1490 https://access.redhat.com/errata/RHSA-2019:1490

Comment 24 errata-xmlrpc 2019-06-17 19:33:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support
  Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.2 Telco Extended Update Support

Via RHSA-2019:1485 https://access.redhat.com/errata/RHSA-2019:1485

Comment 25 errata-xmlrpc 2019-06-17 19:37:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2019:1484 https://access.redhat.com/errata/RHSA-2019:1484

Comment 26 errata-xmlrpc 2019-06-17 19:56:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1480 https://access.redhat.com/errata/RHSA-2019:1480

Comment 27 errata-xmlrpc 2019-06-17 19:56:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2019:1487 https://access.redhat.com/errata/RHSA-2019:1487

Comment 28 errata-xmlrpc 2019-06-17 19:59:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1486 https://access.redhat.com/errata/RHSA-2019:1486

Comment 30 errata-xmlrpc 2019-06-25 09:19:24 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1594 https://access.redhat.com/errata/RHSA-2019:1594

Comment 31 errata-xmlrpc 2019-06-25 18:07:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1602 https://access.redhat.com/errata/RHSA-2019:1602

Comment 32 Sam Fowler 2019-06-27 00:37:08 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4 (RH CoreOS)

Via RHBA-2019:1589 https://access.redhat.com/errata/RHBA-2019:1589

Comment 33 errata-xmlrpc 2019-07-08 09:18:59 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:1699 https://access.redhat.com/errata/RHSA-2019:1699

Comment 39 Product Security DevOps Team 2019-07-12 13:07:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11478


Note You need to log in before you can comment on or make changes to this bug.