Resource exhaustion in Linux kernel - CVE-2019-11478
Published: July 1, 2019 / Updated: May 30, 2020
Vulnerability identifier: #VU18946
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-11478
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to an error when processing TCP Selective Acknowledgment (SACK) sequences within the Linux kernel TCP retransmission queue implementation in tcp_fragment. A remote non-authenticated attacker can send specially crafted network traffic to the affected system and perform a denial of service (DoS) attack.
How to mitigate CVE-2019-11478
Update your kernel to the latest version.
Sources
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.182
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.182
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.127
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.52
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.11
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.189
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.189
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.138
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.4
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.21
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.62
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3