CVE-2019-5599 Denial of service in FreeBSD
An attacker can cause resource exhaustion and denial of service in FreeBSD by exploiting a bug in the non-default RACK TCP stack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5599?
CVE-2019-5599 is a high-severity denial of service vulnerability in Freebsd Freebsd, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service.
Weakness: CWE-770
Which versions are affected by CVE-2019-5599?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2019-5599?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-5599 being exploited?
There is no known exploitation of CVE-2019-5599 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-2c7c-f76h-r8hx.