{"id":35396,"date":"2019-10-31T22:04:04","date_gmt":"2019-10-31T19:04:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii\/"},"modified":"2019-10-31T22:04:04","modified_gmt":"2019-10-31T19:04:04","slug":"uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","title":{"rendered":"Vuln\u00e9rabilit\u00e9s dans les stacks TCP de Linux et FreeBSD menant \u00e0 un d\u00e9ni de service \u00e0 distance","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

L'entreprise Netflix a d\u00e9tect\u00e9<\/a><\/noindex> plusieurs vuln\u00e9rabilit\u00e9s critiques des vuln\u00e9rabilit\u00e9s<\/a><\/noindex> dans les piles TCP de Linux et FreeBSD, qui permettent d'initier \u00e0 distance un plantage du noyau ou de provoquer une surcharge des ressources lors du traitement de paquets TCP sp\u00e9cialement form\u00e9s (packet-of-death). Les probl\u00e8mes sont caus\u00e9s par<\/a><\/noindex> des erreurs dans les gestionnaires de la taille maximale de segment de donn\u00e9es dans le paquet TCP (MSS, Maximum Segment Size) et le m\u00e9canisme d'accus\u00e9 de r\u00e9ception s\u00e9lective des connexions (SACK, TCP Selective Acknowledgement).<\/p>\n

  • CVE-2019-11477<\/a><\/noindex> (SACK Panic) \u2014 le probl\u00e8me appara\u00eet dans les noyaux Linux \u00e0 partir de 2.6.29 et permet de provoquer un crash (panic) du noyau en envoyant une s\u00e9rie de paquets SACK, en raison d'un d\u00e9bordement entier dans le gestionnaire. Pour mener l'attaque, il suffit de d\u00e9finir la valeur MSS de la connexion TCP \u00e0 48 octets (la limite inf\u00e9rieure, qui fixe la taille du segment \u00e0 8 octets) et d'envoyer une s\u00e9quence de paquets SACK agenc\u00e9s d'une certaine mani\u00e8re.\n

    En tant que solutions de contournement, il est possible de d\u00e9sactiver le traitement SACK (en \u00e9crivant 0 dans \/proc\/sys\/net\/ipv4\/tcp_sack) ou de bloquer<\/a><\/noindex> les connexions avec un MSS faible (fonctionne uniquement si sysctl net.ipv4.tcp_mtu_probing est r\u00e9gl\u00e9 \u00e0 0 et peut perturber le fonctionnement de certaines connexions normales avec un MSS faible);<\/p>\n

  • CVE-2019-11478<\/a><\/noindex> (SACK Slowness) \u2014 entra\u00eene une panne du m\u00e9canisme SACK (lors de l'utilisation d'un noyau Linux ant\u00e9rieur \u00e0 4.15) ou une consommation excessive de ressources. Le probl\u00e8me se manifeste lors du traitement de paquets SACK sp\u00e9cialement con\u00e7us, qui peuvent \u00eatre utilis\u00e9s pour fragmenter la file d'attente des retransmissions TCP. Les solutions de contournement de protection sont analogues \u00e0 la vuln\u00e9rabilit\u00e9 pr\u00e9c\u00e9dente.\n
  • CVE-2019-5599<\/a><\/noindex> (SACK Slowness) \u2014 permet de provoquer une fragmentation de la carte des paquets envoy\u00e9s lors du traitement d'une s\u00e9quence sp\u00e9ciale de SACK dans le cadre d'une seule connexion TCP et d'initier une op\u00e9ration gourmande en ressources de v\u00e9rification de la liste. Le probl\u00e8me se manifeste sur FreeBSD 12 avec le m\u00e9canisme de d\u00e9tection de perte de paquets RACK. Comme mesure de contournement, il est possible de d\u00e9sactiver le module RACK.\n
  • CVE-2019-11479<\/a><\/noindex> \u2014 l'attaquant peut provoquer dans le noyau Linux la division des r\u00e9ponses en plusieurs segments TCP, chacun contenant uniquement 8 octets de donn\u00e9es, ce qui peut entra\u00eener une augmentation significative du trafic, une charge accrue sur le CPU et une saturation de la bande passante. Comme m\u00e9thode de contournement de protection, il est recommand\u00e9 de bloquer<\/a><\/noindex> de bloquer les connexions avec un MSS faible.\n<\/ul>\n

    Dans le noyau Linux, les probl\u00e8mes ont \u00e9t\u00e9 corrig\u00e9s dans les versions 4.4.182, 4.9.182, 4.14.127, 4.19.52 et 5.1.11. Le correctif pour FreeBSD est disponible sous forme de d'un correctif<\/a><\/noindex>. Des mises \u00e0 jour du noyau ont d\u00e9j\u00e0 \u00e9t\u00e9 publi\u00e9es pour les distributions de paquets Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>. La correction est en cours de pr\u00e9paration dans Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex> et Arch Linux<\/a><\/noindex>.<\/p>\n

    <\/a><\/noindex><\/p>\n

    Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0445 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 TCP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 (packet-of-death). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 TCP-\u043f\u0430\u043a\u0435\u0442\u0435 (MSS, Maximum segment size) \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (SACK, TCP Selective Acknowledgement). CVE-2019-11477 (SACK Panic) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35396","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9s dans les piles TCP de Linux et FreeBSD, entra\u00eenant un d\u00e9ni de service \u00e0 distance | ProHoster","description":"La soci\u00e9t\u00e9 Netflix a identifi\u00e9 plusieurs vuln\u00e9rabilit\u00e9s critiques","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:04+00:00","article:modified_time":"2019-10-31T19:04:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35396","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:03:04","updated":"2026-01-21 23:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=35396"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35396\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=35396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=35396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=35396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}