CVE-2019-11478 SACK can cause extensive memory use via fragmented resend queue
A remote attacker can cause a denial of service by exploiting TCP SACK handling to exhaust memory in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11478?
CVE-2019-11478 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 18 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
Which versions are affected by CVE-2019-11478?
It affects 24 products.
Linux distribution packages (10)
kgraft-patch-SLE12-SP4_Update_5 SUSE:Linux Enterprise Live Patching 12 SP4 | All versions | 2-2.1 |
kernel-livepatch-SLE15_Update_11 SUSE:Linux Enterprise Live Patching 15 | All versions | 2-2.1 |
kernel-livepatch-SLE15-SP1_Update_1 SUSE:Linux Enterprise Live Patching 15 SP1 | All versions | 3-2.1 |
kernel-livepatch-SLE15-SP1_Update_2 SUSE:Linux Enterprise Live Patching 15 SP1 | All versions | 2-2.1 |
kgraft-patch-SLE12-SP1_Update_34 SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 3-2.1 |
kgraft-patch-SLE12-SP2_Update_30 SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3-2.1 |
kgraft-patch-SLE12-SP3_Update_26 SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 3-2.1 |
kgraft-patch-SLE12-SP1_Update_34 SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 3-2.1 |
kgraft-patch-SLE12-SP2_Update_30 SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3-2.1 |
kgraft-patch-SLE12-SP3_Update_26 SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3-2.1 |
Products include Canonical Ubuntu Linux, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager and 18 more.
How do I fix CVE-2019-11478?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11478 being exploited?
There is no known exploitation of CVE-2019-11478 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-11478, GHSA-xh2h-cw6h-x9h5, SUSE-SU-2019:1888-1, SUSE-SU-2019:1935-1, UBUNTU-CVE-2019-11478.