{"id":35396,"date":"2019-10-31T22:04:04","date_gmt":"2019-10-31T19:04:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii\/"},"modified":"2019-10-31T22:04:04","modified_gmt":"2019-10-31T19:04:04","slug":"uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","title":{"rendered":"Luki w stosach TCP system\u00f3w Linux i FreeBSD prowadz\u0105ce do zdalnej odmowy us\u0142ugi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Netflix ujawnili<\/a><\/noindex> kilka krytycznych vulnerabilities<\/a><\/noindex> w stosach TCP system\u00f3w Linux i FreeBSD, kt\u00f3re umo\u017cliwiaj\u0105 zdalne inicjowanie awarii j\u0105dra lub wywo\u0142anie nadmiernego zu\u017cycia zasob\u00f3w podczas przetwarzania specjalnie skonstruowanych pakiet\u00f3w TCP (packet-of-death). Problemy s\u0105 spowodowane<\/a><\/noindex> b\u0142\u0119dami w obs\u0142udze maksymalnego rozmiaru bloku danych w pakiecie TCP (MSS, Maximum segment size) oraz mechanizmem potwierdzania selektywnego po\u0142\u0105cze\u0144 (SACK, TCP Selective Acknowledgement).<\/p>\n

  • CVE-2019-11477<\/a><\/noindex> (SACK Panic) \u2014 problem wyst\u0119puje w j\u0105drach Linux od wersji 2.6.29 i pozwala na wywo\u0142anie awarii (panic) j\u0105dra poprzez wys\u0142anie serii pakiet\u00f3w SACK, z powodu wyst\u0105pienia przepe\u0142nienia ca\u0142kowitego w obs\u0142udze. Do przeprowadzenia ataku wystarczy ustawi\u0107 warto\u015b\u0107 MSS w 48 bajt\u00f3w (dolna granica, ustawia rozmiar segmentu na 8 bajt\u00f3w) i wys\u0142a\u0107 sekwencj\u0119 odpowiednio skonstruowanych pakiet\u00f3w SACK.\n

    Jako obej\u015bcia ochrony mo\u017cna wy\u0142\u0105czy\u0107 obs\u0142ug\u0119 SACK (zapisa\u0107 0 w \/proc\/sys\/net\/ipv4\/tcp_sack) lub zablokowa\u0107<\/a><\/noindex> po\u0142\u0105czenia z niskim MSS (dzia\u0142a tylko przy ustawieniu sysctl net.ipv4.tcp_mtu_probing na 0 i mo\u017ce zak\u0142\u00f3ci\u0107 dzia\u0142anie niekt\u00f3rych normalnych po\u0142\u0105cze\u0144 z niskim MSS);<\/p>\n

  • CVE-2019-11478<\/a><\/noindex> (SACK Slowness) \u2014 prowadzi do zak\u0142\u00f3cenia dzia\u0142ania mechanizmu SACK (przy u\u017cyciu j\u0105dra Linux starszego ni\u017c 4.15) lub nadmiernego zu\u017cycia zasob\u00f3w. Problem wyst\u0119puje podczas przetwarzania specjalnie skonstruowanych pakiet\u00f3w SACK, kt\u00f3re mog\u0105 by\u0107 u\u017cywane do fragmentacji kolejki retransmisji (TCP retransmission). Obej\u015bcia ochrony s\u0105 podobne do poprzedniej podatno\u015bci;\n
  • CVE-2019-5599<\/a><\/noindex> (SACK Slowness) \u2014 pozwala wywo\u0142a\u0107 fragmentacj\u0119 mapy wys\u0142anych pakiet\u00f3w podczas przetwarzania specjalnej sekwencji SACK w ramach jednego po\u0142\u0105czenia TCP i wywo\u0142a\u0107 wykonanie zasobo\u017cernej operacji przeszukiwania listy. Problem wyst\u0119puje w FreeBSD 12 z mechanizmem wykrywania utraty pakiet\u00f3w RACK. Jako obej\u015bcie mo\u017cna wy\u0142\u0105czy\u0107 modu\u0142 RACK;\n
  • CVE-2019-11479<\/a><\/noindex> \u2014 atakuj\u0105cy mo\u017ce wywo\u0142a\u0107 w j\u0105drze Linux podzia\u0142 odpowiedzi na kilka segment\u00f3w TCP, z kt\u00f3rych ka\u017cdy zawiera tylko 8 bajt\u00f3w danych, co mo\u017ce prowadzi\u0107 do znacznego wzrostu ruchu, zwi\u0119kszenia obci\u0105\u017cenia CPU i zator\u00f3w w kanale komunikacyjnym. Jako metoda ochrony zaleca si\u0119 zablokowa\u0107<\/a><\/noindex> po\u0142\u0105czenia z niskim MSS.\n<\/ul>\n

    W j\u0105drze Linux problemy zosta\u0142y rozwi\u0105zane w wersjach 4.4.182, 4.9.182, 4.14.127, 4.19.52 i 5.1.11. Poprawka dla FreeBSD jest dost\u0119pna w postaci \u0142atki<\/a><\/noindex>. W dystrybucjach aktualizacje pakiet\u00f3w z j\u0105drem zosta\u0142y ju\u017c wydane dla Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>. Poprawka w trakcie przygotowania Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex> i Arch Linux<\/a><\/noindex>.<\/p>\n

    <\/a><\/noindex><\/p>\n

    \u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0445 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 TCP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 (packet-of-death). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 TCP-\u043f\u0430\u043a\u0435\u0442\u0435 (MSS, Maximum segment size) \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (SACK, TCP Selective Acknowledgement). CVE-2019-11477 (SACK Panic) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35396","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitiy w stosach TCP Linux i FreeBSD prowadz\u0105ce do zdalnego odmowy us\u0142ugi | ProHoster","description":"Firma Netflix zidentyfikowa\u0142a kilka krytycznych","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:04+00:00","article:modified_time":"2019-10-31T19:04:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35396","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:03:04","updated":"2026-01-21 23:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/35396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=35396"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/35396\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=35396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=35396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=35396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}