Bug 1719123 (CVE-2019-11477) - CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service
Summary: CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks all...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11477
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20190617:1700...
Depends On: 1719584 1719586 1719590 1719603 1719605 1721059 1719585 1719587 1719588 1719591 1719592 1719593 1719594 1719595 1719596 1719597 1719598 1719599 1719600 1719601 1719602 1719604 1719606 1719607 1720458 1720692 1720693 1721057 1721058 1721119 1721254 1726402 1726403 1726428
Blocks: 1719124 1719214 1719215 1719216 1719217 1719218 1719219
TreeView+ depends on / blocked
 
Reported: 2019-06-11 06:20 UTC by Sam Fowler
Modified: 2019-08-20 02:32 UTC (History)
80 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).
Clone Of:
Environment:
Last Closed: 2019-07-12 13:07:23 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1479 None None None 2019-06-17 18:00:04 UTC
Red Hat Product Errata RHSA-2019:1480 None None None 2019-06-17 19:56:11 UTC
Red Hat Product Errata RHSA-2019:1481 None None None 2019-06-17 18:32:07 UTC
Red Hat Product Errata RHSA-2019:1482 None None None 2019-06-17 19:06:26 UTC
Red Hat Product Errata RHSA-2019:1483 None None None 2019-06-17 19:09:12 UTC
Red Hat Product Errata RHSA-2019:1484 None None None 2019-06-17 19:37:47 UTC
Red Hat Product Errata RHSA-2019:1485 None None None 2019-06-17 19:33:15 UTC
Red Hat Product Errata RHSA-2019:1486 None None None 2019-06-17 19:59:16 UTC
Red Hat Product Errata RHSA-2019:1487 None None None 2019-06-17 19:56:35 UTC
Red Hat Product Errata RHSA-2019:1488 None None None 2019-06-17 18:24:22 UTC
Red Hat Product Errata RHSA-2019:1489 None None None 2019-06-17 19:28:02 UTC
Red Hat Product Errata RHSA-2019:1490 None None None 2019-06-17 19:29:04 UTC
Red Hat Product Errata RHSA-2019:1594 None None None 2019-06-25 09:19:27 UTC
Red Hat Product Errata RHSA-2019:1602 None None None 2019-06-25 18:07:49 UTC
Red Hat Product Errata RHSA-2019:1699 None None None 2019-07-08 09:18:58 UTC

Description Sam Fowler 2019-06-11 06:20:39 UTC
An integer overflow issue was found in the way Linux kernel processes TCP 
Selective Acknowledgement(SACK) segments. While processing SACK segments, Linux 
kernel's socket buffer(SBK) data structure becomes fragmented. Each fragment is 
about TCP MSS bytes. To efficiently process SACK blocks, Linux combines multiple 
fragmented SKB into one. This merging of SKB results in the said integer overflow 
issue, as more number of segments exceed the 16bit width of 
'TCP_SKB_CB(skb)->tcp_gso_segs' parameter in tcp_shifted_skb() routine.

A remote attacker could use this flaw to crash the Linux kernel by sending a 
crafted sequence of SACK segments on a TCP connection with minimum value of TCP 
MSS, resulting in DoS.

Upstream patch:
---------------
  -> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b4929f65b0d8249f19a50245cd88ed1a2f78cff

Reference:
----------
  -> https://www.ietf.org/rfc/rfc2018.txt
  -> http://vger.kernel.org/~davem/skb_data.html
  -> https://git.kernel.org/linus/832d11c5cd076abc0aa1eaf7be96c81d1a59ce41

Comment 10 Prasad J Pandit 2019-06-17 07:02:10 UTC
Acknowledgments:

Name: Jonathan Looney (Netflix Information Security)

Comment 11 Petr Matousek 2019-06-17 08:33:18 UTC
Statement:

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Comment 12 Petr Matousek 2019-06-17 08:33:21 UTC
Mitigation:

For mitigation, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Comment 15 Petr Matousek 2019-06-17 17:21:50 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1721254]

Comment 18 errata-xmlrpc 2019-06-17 18:00:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1479 https://access.redhat.com/errata/RHSA-2019:1479

Comment 19 errata-xmlrpc 2019-06-17 18:24:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1488 https://access.redhat.com/errata/RHSA-2019:1488

Comment 20 errata-xmlrpc 2019-06-17 18:32:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1481 https://access.redhat.com/errata/RHSA-2019:1481

Comment 21 errata-xmlrpc 2019-06-17 19:06:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2019:1482 https://access.redhat.com/errata/RHSA-2019:1482

Comment 22 errata-xmlrpc 2019-06-17 19:09:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Extended Update Support

Via RHSA-2019:1483 https://access.redhat.com/errata/RHSA-2019:1483

Comment 23 errata-xmlrpc 2019-06-17 19:27:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support

Via RHSA-2019:1489 https://access.redhat.com/errata/RHSA-2019:1489

Comment 24 errata-xmlrpc 2019-06-17 19:29:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support

Via RHSA-2019:1490 https://access.redhat.com/errata/RHSA-2019:1490

Comment 25 errata-xmlrpc 2019-06-17 19:33:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support
  Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.2 Telco Extended Update Support

Via RHSA-2019:1485 https://access.redhat.com/errata/RHSA-2019:1485

Comment 26 errata-xmlrpc 2019-06-17 19:37:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2019:1484 https://access.redhat.com/errata/RHSA-2019:1484

Comment 27 errata-xmlrpc 2019-06-17 19:56:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1480 https://access.redhat.com/errata/RHSA-2019:1480

Comment 28 errata-xmlrpc 2019-06-17 19:56:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2019:1487 https://access.redhat.com/errata/RHSA-2019:1487

Comment 29 errata-xmlrpc 2019-06-17 19:59:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1486 https://access.redhat.com/errata/RHSA-2019:1486

Comment 32 errata-xmlrpc 2019-06-25 09:19:24 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1594 https://access.redhat.com/errata/RHSA-2019:1594

Comment 33 errata-xmlrpc 2019-06-25 18:07:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1602 https://access.redhat.com/errata/RHSA-2019:1602

Comment 34 Sam Fowler 2019-06-27 00:36:23 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4 (RH CoreOS)

Via RHBA-2019:1589 https://access.redhat.com/errata/RHBA-2019:1589

Comment 35 errata-xmlrpc 2019-07-08 09:18:55 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:1699 https://access.redhat.com/errata/RHSA-2019:1699

Comment 36 Product Security DevOps Team 2019-07-12 13:07:23 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11477


Note You need to log in before you can comment on or make changes to this bug.