#VU18946 Resource exhaustion in Linux kernel - CVE-2019-11478
Published: July 1, 2019 / Updated: May 30, 2020
Vulnerability identifier: #VU18946
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-11478
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to an error when processing TCP Selective Acknowledgment (SACK) sequences within the Linux kernel TCP retransmission queue implementation in tcp_fragment. A remote non-authenticated attacker can send specially crafted network traffic to the affected system and perform a denial of service (DoS) attack.
Remediation
Update your kernel to the latest version.
External links
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.182
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.182
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.127
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.52
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.11
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.189
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.189
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.138
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.4
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.21
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.62
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3