Bug 2295326 (CVE-2024-39920) - CVE-2024-39920 kernel: TCP: SnailLoad timing side channel in TCP
Summary: CVE-2024-39920 kernel: TCP: SnailLoad timing side channel in TCP
Keywords:
Status: NEW
Alias: CVE-2024-39920
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2295785
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-03 06:11 UTC by OSIDB Bzimport
Modified: 2024-09-11 05:58 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the TCP protocol in RFC 9293. The TCP protocol has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server) when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-03 06:11:11 UTC 
The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.
Note You need to log in before you can comment on or make changes to this bug.