{"id":35396,"date":"2019-10-31T22:04:04","date_gmt":"2019-10-31T19:04:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii\/"},"modified":"2019-10-31T22:04:04","modified_gmt":"2019-10-31T19:04:04","slug":"uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een stivele TCP Linux \u0219i FreeBSD care conduc la atacuri de tip denial of service de la distan\u021b\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Netflix a eviden\u021biat<\/a><\/noindex> c\u00e2teva probleme critice vulnerabilit\u0103\u021bi<\/a><\/noindex> \u00een stivele TCP din Linux \u0219i FreeBSD, care permit ini\u021bierea de la distan\u021b\u0103 a unei pr\u0103bu\u0219iri a nucleului sau cauzarea unui consum excesiv de resurse \u00een procesarea pachetelor TCP special formatate (packet-of-death). Problemele sunt cauzate<\/a><\/noindex> de erori \u00een gestionarea dimensiunii maxime a segmentului de date \u00een pachetul TCP (MSS, Maximum segment size) \u0219i mecanismul de confirmare selectiv\u0103 a conexiunilor (SACK, TCP Selective Acknowledgement).<\/p>\n

  • CVE-2019-11477<\/a><\/noindex> (SACK Panic) \u2014 Problema apare \u00een nucleele Linux \u00eencep\u00e2nd cu 2.6.29 \u0219i permite provocarea unei c\u0103deri (panic) a nucleului prin trimiterea unei serii de pachete SACK din cauza unui overflow \u00een handler. Pentru atac, este suficient s\u0103 se seteze valoarea MSS pentru conexiunea TCP la 48 de octe\u021bi (limita inferioar\u0103, care stabile\u0219te dimensiunea segmentului la 8 octe\u021bi) \u0219i s\u0103 se trimit\u0103 o secven\u021b\u0103 de pachete SACK aranjate \u00eentr-un mod specific.\n

    Ca solu\u021bii de ap\u0103rare, se poate dezactiva gestionarea SACK (set\u00e2nd 0 \u00een \/proc\/sys\/net\/ipv4\/tcp_sack) sau bloca<\/a><\/noindex> conexiunile cu MSS mic (func\u021bioneaz\u0103 doar c\u00e2nd se seteaz\u0103 sysctl net.ipv4.tcp_mtu_probing la 0 \u0219i ar putea afecta func\u021bionarea unor conexiuni normale cu MSS mic);<\/p>\n

  • CVE-2019-11478<\/a><\/noindex> (SACK Slowness) \u2014 Duce la \u00eentreruperea func\u021bion\u0103rii mecanismului SACK (\u00een utilizarea nucleului Linux mai vechi de 4.15) sau la consumul excesiv de resurse. Problema se manifest\u0103 la procesarea pachetelor SACK formate special, care pot fi utilizate pentru fragmentarea cozii de retransmisie TCP. M\u0103surile de protec\u021bie sunt similare vulnerabilit\u0103\u021bii precedente;\n
  • CVE-2019-5599<\/a><\/noindex> (SACK Slowness) \u2014 Permite provocarea fragment\u0103rii h\u0103r\u021bii pachetelor trimise \u00een timpul proces\u0103rii unei secven\u021be speciale de SACK \u00eentr-o singur\u0103 conexiune TCP \u0219i provocarea execut\u0103rii unei opera\u021bii consumatoare de resurse pentru parcurgerea listei. Problema se manifest\u0103 \u00een FreeBSD 12 cu mecanismul de determinare a pierderii pachetelor RACK. Ca m\u0103sur\u0103 de precau\u021bie, se poate dezactiva modulul RACK;\n
  • CVE-2019-11479<\/a><\/noindex> \u2014 Atacatorul poate determina \u00een nucleul Linux divizarea r\u0103spunsurilor \u00een mai multe segmente TCP, fiecare incluz\u00e2nd doar 8 octe\u021bi de date, ceea ce poate duce la o cre\u0219tere semnificativ\u0103 a traficului, la o cre\u0219tere a \u00eenc\u0103rc\u0103rii CPU \u0219i la congestionarea canalului de comunica\u021bie. Ca metod\u0103 de protec\u021bie, se recomand\u0103 bloca<\/a><\/noindex> conexiunile cu MSS mic.\n<\/ul>\n

    \u00cen nucleul Linux, problemele au fost rezolvate \u00een versiunile 4.4.182, 4.9.182, 4.14.127, 4.19.52 \u0219i 5.1.11. Corecturile pentru FreeBSD sunt disponibile sub form\u0103 de patch<\/a><\/noindex>. Actualiz\u0103rile pachetelor cu kernel au fost deja lansate pentru Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>. Corec\u021bia este \u00een curs de preg\u0103tire \u00een Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex> \u0219i Arch Linux<\/a><\/noindex>.<\/p>\n

    <\/a><\/noindex><\/p>\n

    Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0445 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 TCP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 (packet-of-death). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 TCP-\u043f\u0430\u043a\u0435\u0442\u0435 (MSS, Maximum segment size) \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (SACK, TCP Selective Acknowledgement). CVE-2019-11477 (SACK Panic) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35396","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een stivele TCP ale Linux \u0219i FreeBSD, care pot duce la un atac de refuz de serviciu la distan\u021b\u0103 | ProHoster","description":"Compania Netflix a identificat c\u00e2teva vulnerabilit\u0103\u021bi critice","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:04+00:00","article:modified_time":"2019-10-31T19:04:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35396","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:03:04","updated":"2026-01-21 23:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35396"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35396\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}