← back
CVE-2019-11478mediumCWE-770

SACK can cause extensive memory use via fragmented resend queue

35Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 95%
exploitation probability
95%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Affected
1 product
Red Hat Enterprise Linux 5
workaround: For mitigation, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/tcpsack
Fixed
53 products (987 components)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux Server EUS (v. 7.4) · Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Enterprise Linux Server (v. 6) · and others 48
In short

A flaw in Linux kernel's TCP handling allows a remote attacker to send specially crafted network packets that cause excessive memory use and crash the system. The issue happens when the system tries to reassemble fragmented data using SACK (Selective Acknowledgment) sequences.

Technical detail

The vulnerability exists in tcp_fragment() where improper handling of SACK sequences causes pathological fragmentation of the TCP retransmission queue. A remote attacker can exploit this via specially crafted TCP packets to exhaust memory and trigger a denial of service, affecting all unpatched kernel versions prior to the listed fixes.

Summary generated and translated by AI from the official description.
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Linux · Linux kernel