{"id":35396,"date":"2019-10-31T22:04:04","date_gmt":"2019-10-31T19:04:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii\/"},"modified":"2019-10-31T22:04:04","modified_gmt":"2019-10-31T19:04:04","slug":"uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","title":{"rendered":"Vulnerabilidades en las pilas TCP de Linux y FreeBSD que conducen a una denegaci\u00f3n de servicio remoto.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La empresa Netflix ha identificado<\/a><\/noindex> varios cr\u00edticos vulnerabilidades<\/a><\/noindex> en las pilas TCP de Linux y FreeBSD, que permiten iniciar remotamente un colapso del n\u00facleo o provocar un consumo excesivo de recursos al procesar paquetes TCP especialmente dise\u00f1ados (packet-of-death). Los problemas son causados<\/a><\/noindex> por errores en los controladores del tama\u00f1o m\u00e1ximo de bloque de datos en el paquete TCP (MSS, Maximum Segment Size) y en el mecanismo de reconocimiento selectivo de conexiones (SACK, TCP Selective Acknowledgement).<\/p>\n

  • CVE-2019-11477<\/a><\/noindex> (SACK Panic) \u2014 el problema se manifiesta en los n\u00facleos de Linux a partir de la versi\u00f3n 2.6.29 y permite causar un fallo (panic) del n\u00facleo al enviar una serie de paquetes SACK debido a un desbordamiento de enteros en el manejador. Para llevar a cabo el ataque, solo se necesita establecer el valor MSS en 48 bytes para la conexi\u00f3n TCP (el l\u00edmite inferior, establece el tama\u00f1o del segmento en 8 bytes) y enviar una secuencia de paquetes SACK organizados de determinada manera.\n

    Como medidas de protecci\u00f3n alternativas, se puede desactivar el procesamiento de SACK (escribiendo 0 en \/proc\/sys\/net\/ipv4\/tcp_sack) o bloquear<\/a><\/noindex> las conexiones con un MSS bajo (funciona solo si se establece sysctl net.ipv4.tcp_mtu_probing en 0 y puede interrumpir el funcionamiento de algunas conexiones normales con un MSS bajo);<\/p>\n

  • CVE-2019-11478<\/a><\/noindex> (SACK Slowness) \u2014 causa una interrupci\u00f3n en el funcionamiento del mecanismo SACK (cuando se utiliza un n\u00facleo de Linux anterior a la versi\u00f3n 4.15) o un consumo excesivo de recursos. El problema se manifiesta al procesar paquetes SACK espec\u00edficamente dise\u00f1ados, que pueden utilizarse para fragmentar la cola de retransmisi\u00f3n TCP. Las medidas alternativas de protecci\u00f3n son similares a las de la vulnerabilidad anterior;\n
  • CVE-2019-5599<\/a><\/noindex> (SACK Slowness) \u2014 permite la fragmentaci\u00f3n del mapa de paquetes enviados al procesar una secuencia especial de SACK dentro de una \u00fanica conexi\u00f3n TCP y provoca la ejecuci\u00f3n de una operaci\u00f3n intensiva en recursos para recorrer la lista. El problema se manifiesta en FreeBSD 12 con el mecanismo de detecci\u00f3n de p\u00e9rdida de paquetes RACK. Como medida alternativa, se puede desactivar el m\u00f3dulo RACK;\n
  • CVE-2019-11479<\/a><\/noindex> \u2014 un atacante puede provocar en el n\u00facleo de Linux la divisi\u00f3n de las respuestas en varios segmentos TCP, cada uno de los cuales incluye solo 8 bytes de datos, lo que puede llevar a un aumento significativo del tr\u00e1fico, un incremento en la carga del CPU y saturar el canal de comunicaci\u00f3n. Se recomienda como m\u00e9todo de defensa alternativo. bloquear<\/a><\/noindex> las conexiones con un MSS bajo.\n<\/ul>\n

    En el n\u00facleo de Linux, los problemas se han corregido en las versiones 4.4.182, 4.9.182, 4.14.127, 4.19.52 y 5.1.11. La correcci\u00f3n para FreeBSD est\u00e1 disponible como parche<\/a><\/noindex>. En las distribuciones, ya se han lanzado actualizaciones de paquetes con el n\u00facleo para Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>. Correcci\u00f3n en proceso de preparaci\u00f3n en Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex> y Arch Linux<\/a><\/noindex>.<\/p>\n

    <\/a><\/noindex><\/p>\n

    Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0445 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 TCP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 (packet-of-death). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 TCP-\u043f\u0430\u043a\u0435\u0442\u0435 (MSS, Maximum segment size) \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (SACK, TCP Selective Acknowledgement). CVE-2019-11477 (SACK Panic) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35396","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidades en las pilas TCP de Linux y FreeBSD que provocan denegaciones de servicio remotas | ProHoster","description":"Netflix ha identificado varias cr\u00edticas","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:04+00:00","article:modified_time":"2019-10-31T19:04:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35396","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:03:04","updated":"2026-01-21 23:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/35396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=35396"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/35396\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=35396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=35396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=35396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}