Linux Kernel TCP Stack Vulnerabilities Disclosed by Netflix

On 17 June 2019, the Netflix security research team released an advisory detailing multiple vulnerabilities in the TCP-stack for the Linux and FreeBSD kernels. The vulnerabilities affect how these kernels interact and process specially crafted minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. Netflix claims the most serious of the vulnerabilities, dubbed "SACK Panic", can be used to remotely trigger a kernel panic on recent Linux kernels.

Recommendations

• Apply the patches for CVE-2019-11477,11478,11479 and 5599 listed on the linked advisory
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to these vulnerabilities
• If you cannot patch, consider the "Workarounds" on the linked advisory

Details

SACK is a standard under RFC-2018 which allows servers in a TCP connection to selectively acknowledge TCP packets to their clients in the case of dropped packets. MSS allows clients to specify the total amount of data contained in a reconstructed TCP segment. By manipulating small MSS sizes, the researchers abused these two features within Linux and FreeBSD kernels to exhaust the processing power of vulnerable servers. Successful exploitation of these CVEs may result in a DDoS. In the case of the most severe vulnerability, CVE-2019-11477, a kernel panic may be triggered.

The researchers released patches on their advisory on Github. 2 of the 4 vulnerabilities have a patch and 2 workarounds, while the remaining 2 have 1 workaround.