{"id":35396,"date":"2019-10-31T22:04:04","date_gmt":"2019-10-31T19:04:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii\/"},"modified":"2019-10-31T22:04:04","modified_gmt":"2019-10-31T19:04:04","slug":"uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","title":{"rendered":"Varnostne pomanjkljivosti v TCP-skih skladih Linux in FreeBSD, ki vodijo do oddaljenega onemogo\u010danja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Podjetje Netflix je odkrilo<\/a><\/noindex> nekaj kriti\u010dnih ranjivosti<\/a><\/noindex> v TCP skladih Linux in FreeBSD, ki omogo\u010dajo oddaljeno spro\u017eitev zru\u0161itve jedra ali povzro\u010ditev prekomerne porabe virov pri obravnavi posebno oblikovanih TCP paketov (packet-of-death). Te\u017eave so povzro\u010dene<\/a><\/noindex> z napakami v obvladovalnikih najve\u010dje velikosti podatkovnega bloka v TCP paketu (MSS, najve\u010dja velikost segmenta) in mehanizma selektivnega potrjevanja povezav (SACK, TCP Selective Acknowledgement).<\/p>\n

  • CVE-2019-11477<\/a><\/noindex> (SACK Panic) \u2014 te\u017eava se pojavlja v jedrih Linuxa od razli\u010dice 2.6.29 dalje in omogo\u010da zru\u0161itev (panic) jedra preko po\u0161iljanja serije SACK paketov, kar nastane zaradi celotnega \u0161tevila prelivanja v obdelovalcu. Za napad je dovolj, da se za TCP povezavo nastavi vrednost MSS na 48 bajtov (spodnja meja, nastavljen segment velikosti 8 bajtov) in po\u0161lje zaporedje posebno oblikovanih SACK paketov.\n

    Kot obvodne za\u0161\u010ditne ukrepe je mogo\u010de onemogo\u010diti obravnavo SACK (zapisati 0 v \/proc\/sys\/net\/ipv4\/tcp_sack) ali blokirati<\/a><\/noindex> povezave z nizkim MSS (deluje le, \u010de je sysctl net.ipv4.tcp_mtu_probing nastavljen na 0 in lahko moti delovanje nekaterih normalnih povezav z nizkim MSS);<\/p>\n

  • CVE-2019-11478<\/a><\/noindex> (SACK Slowness) \u2014 povzro\u010di motnjo v delovanju mehanizma SACK (pri uporabi jedra Linux starej\u0161ega od 4.15) ali pretirano porabo virov. Te\u017eava se pojavlja pri obdelavi posebej oblikovanih SACK paketov, ki jih je mogo\u010de uporabiti za fragmentacijo \u010dakalne vrste ponovnih prenosov (TCP retransmission). Obhodni na\u010dini za\u0161\u010dite so podobni prej\u0161nji ranljivosti;\n
  • CVE-2019-5599<\/a><\/noindex> (SACK Slowness) \u2014 omogo\u010da povzro\u010ditev fragmentacije mre\u017ene karte poslanih paketov pri obdelavi posebne zaporedne SACK v okviru enega TCP povezave in spro\u017ei izvajanje zahtevnega seznama operacij. Te\u017eava se pojavlja v FreeBSD 12 z mehanizmom za ugotavljanje izgube paketov RACK. Kot obhodna re\u0161itev je mogo\u010de onemogo\u010diti modul RACK;\n
  • CVE-2019-11479<\/a><\/noindex> \u2014 napadalec lahko v jedru Linux povzro\u010di delitev odgovorov na ve\u010d TCP segmentov, pri \u010demer vsak vklju\u010duje le 8 bajtov podatkov, kar lahko privede do znatnega pove\u010danja prometa, pove\u010dane obremenitve CPU in zasi\u010denja komunikacijskega kanala. Kot obhodni na\u010din za\u0161\u010dite je priporo\u010deno blokirati<\/a><\/noindex> povezave z nizkim MSS.\n<\/ul>\n

    V jedru Linux so te\u017eave odpravljene v izdajah 4.4.182, 4.9.182, 4.14.127, 4.19.52 in 5.1.11. Popravilo za FreeBSD je na voljo v obliki popravka<\/a><\/noindex>. V distribucijah so \u017ee izdana posodobitev paketov s jedrom za Debian<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>. Popravek se pripravlja v Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex> in Arch Linux<\/a><\/noindex>.<\/p>\n

    <\/a><\/noindex><\/p>\n

    Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0445 \u044f\u0434\u0440\u0430 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 TCP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 (packet-of-death). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 TCP-\u043f\u0430\u043a\u0435\u0442\u0435 (MSS, Maximum segment size) \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (SACK, TCP Selective Acknowledgement). CVE-2019-11477 (SACK Panic) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35396","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivosti v TCP-stekih Linux in FreeBSD, ki vodijo do oddaljene motnje storitev | ProHoster","description":"Podjetje Netflix je odkrilo ve\u010d kriti\u010dnih","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 TCP-\u0441\u0442\u0435\u043a\u0430\u0445 Linux \u0438 FreeBSD, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Netflix \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-tcp-stekah-linux-i-freebsd-privodyashhie-k-udalyonnomu-otkazu-v-obsluzhivanii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:04+00:00","article:modified_time":"2019-10-31T19:04:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35396","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:03:04","updated":"2026-01-21 23:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/35396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=35396"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/35396\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=35396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=35396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=35396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}