Értesítés Linux Biztonsági Sebezhetőségről (CVE-2019-11477 & CVE-2019-11478)

6. Szerverhoszting > Dedikált szerver
Tisztelt Ügyfelünk,
 
 A kiszolgálók lehető legjobb biztonságának fenntartása érdekében megkérjük, hogy olvassa el a következő Linux és FreeBSD rendszerek sérülékenységről szóló közleményeket és szükség esetén biztosítsa a jelzett frissítések alkalmazását!
 
1: CVE-2019-11477: SACK Panic (Linux >= 2.6.29) - CVSS di 7.5
Description: A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic.
Fix: Apply the patch PATCH_net_1_4.patch. Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch PATCH_net_1a.patch.
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)

2: CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions)

Description: It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Fix: Apply the patch PATCH_net_2_4.patch
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
 
References:
Please consider these vulnerabilities as high level.
 
 

Ha kérdése van, kérjük, lépjen kapcsolatba Ügyfélszolgálatunkkal egy hiteles kérés megnyitásával.
Article ID: 572, , Modified: 5/12/2023 at 10:05 AM

Was this article helpful?

Share this article