ProHoster > Blog > Internet News > Vulnerabilities in the TCP stacks of Linux and FreeBSD leading to remote denial of service.
Vulnerabilities in the TCP stacks of Linux and FreeBSD leading to remote denial of service.
Netflix Company several critical in TCP stacks of Linux and FreeBSD that allow remote initiation of a kernel crash or cause excessive resource consumption when processing specially crafted TCP packets (packet-of-death). The issues errors in the maximum segment size (MSS, Maximum Segment Size) handlers and the selective acknowledgment (SACK, TCP Selective Acknowledgement) mechanism.
(SACK Panic) — the issue manifests in Linux kernels starting with 2.6.29 and allows a kernel panic to be triggered by sending a series of SACK packets due to an integer overflow in the handler. To perform the attack, it is sufficient to set the MSS value for the TCP connection to 48 bytes (the lower limit, which sets the segment size to 8 bytes) and send a sequence of specifically arranged SACK packets.
As a workaround for protection, SACK processing can be disabled (by setting 0 in /proc/sys/net/ipv4/tcp_sack) or connections with low MSS (works only when the sysctl net.ipv4.tcp_mtu_probing is set to 0 and may disrupt the operation of some normal connections with low MSS);
(SACK Slowness) — leads to disruption of the SACK mechanism (when using kernels older than Linux 4.15) or excessive resource consumption. The issue manifests when processing specially crafted SACK packets that can be used to fragment the TCP retransmission queue. Workarounds are similar to the previous vulnerability;
(SACK Slowness) — allows for fragmentation of the packet sending map when processing a specific sequence of SACK within a single TCP connection and triggers the execution of a resource-intensive list enumeration operation. The issue manifests in FreeBSD 12 with the RACK packet loss detection mechanism. As a workaround, the RACK module can be disabled;
— an attacker can cause the Linux kernel to split responses into several TCP segments, each containing only 8 bytes of data, which may lead to a significant increase in traffic, greater CPU load, and saturation of the communication channel. As a protective workaround, it is recommended to use connections with low MSS.
In the Linux kernel, the issues have been fixed in releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, and 5.1.11. A fix for FreeBSD is available as In the distributions, updates for the kernel packages have already been released for , , A fix is being prepared for , and .
