A security researcher working for Netflix has revealed that potentially critical flaws have hit the Linux kernel that can be exploited by a remote, unverified attacker to mount denial-of-service (DoS) attacks.

The vulnerabilities are related to how the kernel deals with TCP Selective Acknowledgement (SACK) packets with a low minimum segment size (MSS), and could affect numerous devices, including servers, Android smartphones and embedded devices.

Exploitation includes sending particularly created packets to the targeted device and some believe the vulnerabilities could have substantial and extensive impact.

A total of three security flaws have been recognized. Dubbed SACK Panic and tracked as CVE-2019-11477, the most critical of them affects Linux kernel versions starting with 2.6.29, which was issued in 2009.

Another flaw, tracked as CVE-2019-11478 and dubbed SACK Slowness, impacts all versions of the Linux kernel prior to 4.15. This weakness also impacts the FreeBSD kernel if the RACK TCP Stack is used. The CVE identifier CVE-2019-5599 has been assigned to the FreeBSD version of this vulnerability.

Tracked as CVE-2019-11479, the last flaw is linked only to MSS; the first two problems are related to both SACK and MSS.

Netflix has issued an advisory stating the vulnerabilities and Red Hat has published a thorough account of the issues. Security advisories for the susceptibilities have also been published by AWSCanonical (for Ubuntu), DebianSUSE, CoreOS, Oracle (for Oracle Linux), and Arch Linux.

Kernel updates that patch these weaknesses are available. Users who cannot install the patches can implement numerous extenuations, such as disabling SACK processing and blocking connections with a low MSS.

Nevertheless, Red Hat warned that some extenuations “might affect traffic from legitimate sources that require the lower MSS values to transmit correctly and system performance.”

Cloudflare says it has come up with patches to its infrastructure to defend customers against potential attacks. “If you’re behind Cloudflare you’re safe as long as you allow only connections from us,” explained Cloudflare CTO John Graham-Cumming.

Leave a Reply

Your email address will not be published. Required fields are marked *