Live data from Hacker News

SACK Panic – Multiple TCP-based remote denial-of-service issues

access.redhat.com

21–30 of 134 posts

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#21

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

Here are the security tracker links for Debian

https://security-tracker.debian.org/tracker/CVE-2019-11477

https://security-tracker.debian.org/tracker/CVE-2019-11478

https://security-tracker.debian.org/tracker/CVE-2019-11479

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#22
post #10
post #4

That BUG_ON is a full up kernel panic? That's a pretty severe issue if so.

Yes. In all seriousness, this is a "drop everything and patch" situation, as soon as the patches are available. It's a little bit more involved than a ping of death, but still, relatively easy to exploit.

Seems like anybody with an open TCP port and SACK enabled (the default) is vulnerable.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#23

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

SLES info is here already: https://www.suse.com/de-de/support/kb/doc/?id=7023928

Disclaimer: I work for SUSE

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#24
post #6
post #3

Earlier quoted context omitted.

That seems to have a bit more information, so we switched to it from https://www.openwall.com/lists/oss-security/2019/06/17/5 . Thanks!

The original link includes links to the patches. Fascinating how the SACK MSS problem seems to be a relatively simple situation nobody realized can occur.

You'd have to dig pretty deep to realize that the kernel structure is limited to just 17 entries, and then do the math with minimum packet sizes vs. header sizes.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#25
This is the way I block such things on my own VM's (not at work) using iptables:

    iptables -t raw -I PREROUTING -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m tcpmss ! --mss 640:65535 -j DROP
Here it is in action:

    iptables -L -n -v -t raw | grep mss  
    84719 3392K DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 tcpmss match !640:65535

My settings may be a little aggressive and may block some old pptp/ppoe users. Perhaps 520 would be a safer low end. As a funny side note, this also blocks hping3's default settings (ping floods) as it doesn't set mss. This also blocks a slew of really poorly coded scanners.

For everything else at work, we are behind a layer 7 load balancer that is not vulnerable.

You may also find it useful to block fragmented packets. I've done this for years and never had an issue:

    iptables -t raw -I PREROUTING -i eth0 -f -j DROP
If you have the PoC, then feel free to first verify you can browse to https://tinyvpn.org/ then send the small MSS packets to that domain, then see if you can still browse to it. I don't care if the server reboots or crashes. Just don't send DDoS please, as the provider will complain to me.

To see the counters increase, here is a quick and silly cron job that will show you the MSS DROPs in the last minute, that I will disable after a couple days: [1]

[1] - https://tinyvpn.org/up/mss/

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#26
post #21

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

Here are the security tracker links for Debian https://security-tracker.debian.org/tracker/CVE-2019-11477 https://security-tracker.debian.org/tracker/CVE-2019-11478 https://security-tracker.debian.org/tracker/CVE-2019-11479

Thank you, integrated.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#27

AWS Bulletin: https://aws.amazon.com/security/security-bulletins/AWS-2019-... FYI if your instances are behind an Application Load Balancer or Classic Load Balancer then they are protected, but NOT if they are behind a Network Load Balancer. A patched kernel is available for Amazon Linux 1 and 2, so you won't have to disable SACK. You can run "sudo yum update kernel" to get it, but of course you have to reboot. Updat…

Even if your instances are behind ALBs or ELBs they may not be protected if they make outbound connections to the internet.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#28

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

SLES info is here already: https://www.suse.com/de-de/support/kb/doc/?id=7023928 Disclaimer: I work for SUSE

Thank you, integrated. Please alert your internal team the official front end to find these is not updated: https://www.suse.com/support/update/

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#29

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

Thanks for this. Any chance you can you edit the comment to make the links clicky please?
Post reply on HN