Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SACK Panic – Multiple TCP-based remote denial-of-service issues

access.redhat.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#14

Post by talawahtech »

AWS Bulletin: https://aws.amazon.com/security/security-bulletins/AWS-2019-...

FYI if your instances are behind an Application Load Balancer or Classic Load Balancer then they are protected, but NOT if they are behind a Network Load Balancer.

A patched kernel is available for Amazon Linux 1 and 2, so you won't have to disable SACK. You can run "sudo yum update kernel" to get it, but of course you have to reboot. Updated AMIs are also available.

Amazon Linux 1: https://alas.aws.amazon.com/ALAS-2019-1222.html Amazon Linux 2: https://alas.aws.amazon.com/AL2/ALAS-2019-1222.html

For Amazon Linux 2 the fixed kernel is kernel-4.14.123-111.109.amzn2. Looking at my instances, it look like I have been on that version since Friday.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#18

Post by gravitas »

I'm collecting vendor links internally for work:

Red Hat / CentOS

https://access.redhat.com/security/vulnerabilities/tcpsack

https://access.redhat.com/security/cve/cve-2019-11477

https://access.redhat.com/security/cve/cve-2019-11478

https://access.redhat.com/security/cve/cve-2019-11479

Ubuntu

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2...

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2...

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2...

Oracle Linux

https://linux.oracle.com/errata/ELSA-2019-4686.html (RHCK kernel)

https://linux.oracle.com/errata/ELSA-2019-4685.html (UEK5 kernel)

https://linux.oracle.com/errata/ELSA-2019-4684.html (UEK4 kernel)

Amazon AWS

https://aws.amazon.com/security/security-bulletins/AWS-2019-...

https://alas.aws.amazon.com/ALAS-2019-1222.html (Linux 1)

https://alas.aws.amazon.com/AL2/ALAS-2019-1222.html (Linux 2)

Debian

https://security-tracker.debian.org/tracker/CVE-2019-11477

https://security-tracker.debian.org/tracker/CVE-2019-11478

https://security-tracker.debian.org/tracker/CVE-2019-11479

SUSE / SLES

https://www.suse.com/de-de/support/kb/doc/?id=7023928

https://www.suse.com/security/cve/CVE-2019-11477/

https://www.suse.com/security/cve/CVE-2019-11478/

https://www.suse.com/security/cve/CVE-2019-11479/

CoreOS

https://coreos.com/releases/#2079.6.0

Arch

https://security.archlinux.org/AVG-983

https://security.archlinux.org/CVE-2019-11477

https://security.archlinux.org/CVE-2019-11478

https://security.archlinux.org/CVE-2019-11479

(please reply with additional vendor links if you have them)

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#19

Post by shereadsthenews »

megous wrote: post #17
shereadsthenews wrote: post #15

Looks like the issue was fixed upstream a month ago. Might have been nice to know earlier? Is this how long it takes for the distros to lurch into action?

The fix was pushed just now to stable kernels.

That's just a detail of how linux is developed. The fixing patch was mailed on May 17th and it mentions the CVE.
Post reply on HN