Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SACK Panic – Multiple TCP-based remote denial-of-service issues

access.redhat.com

Post reply on HN
Print view View original

41–50 of 134 posts

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#41

Post by syn0byte »

foofc7c8 wrote: post #35
syn0byte wrote: post #32

Earlier quoted context omitted.

No, not "any system". Besides needing SACK enabled (which is by default) you also need segment offloading and non-shite networking hardware that will respect and preserve stupid MSS fields in packets. pending a patch simply disable SACK: ~$ echo 0 > /proc/sys/net/ipv4/tcp_sack and/or disable segmentation offloading: ~$ ethtool -K eth? tso off TCP and Checksum offloading still aren't super standard on customer grade N…

Can't find anywhere prerequisite on segment offloading, any link on this?

The link to the article....

"When Segmentation offload is on and SACK mechanism is also enabled, due to packet loss and selective retransmission of some packets, SKB could end up holding multiple packets, counted by ‘tcp_gso_segs’."

Segmentation offload in linux is dependent on checksum offloads per here:

https://www.kernel.org/doc/Documentation/networking/segmenta...

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#42

Post by acdha »

syn0byte wrote: post #32
jkern wrote: post #5

So you can remotely cause a kernel panic on basically any system with kernel newer than 2.6.28? The doesn't sound great

No, not "any system". Besides needing SACK enabled (which is by default) you also need segment offloading and non-shite networking hardware that will respect and preserve stupid MSS fields in packets. pending a patch simply disable SACK: ~$ echo 0 > /proc/sys/net/ipv4/tcp_sack and/or disable segmentation offloading: ~$ ethtool -K eth? tso off TCP and Checksum offloading still aren't super standard on customer grade N…

> TCP and Checksum offloading still aren't super standard on customer grade NICs or virtual machines.

I thought VMware shipped that at least decade ago — is there some specific sub-feature you had in mind? Similarly, at least Apple's consumer hardware had checksum offloading back in the early 2000s and segmentation support shipped in 10.6 (2009) so it seems like it should be relatively mainstream since they tended to use commodity NIC hardware.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#43

Post by loeg »

oasisbob wrote: post #34
syn0byte wrote: post #32

Earlier quoted context omitted.

No, not "any system". Besides needing SACK enabled (which is by default) you also need segment offloading and non-shite networking hardware that will respect and preserve stupid MSS fields in packets. pending a patch simply disable SACK: ~$ echo 0 > /proc/sys/net/ipv4/tcp_sack and/or disable segmentation offloading: ~$ ethtool -K eth? tso off TCP and Checksum offloading still aren't super standard on customer grade N…

Isn't TSO enabled on EC2? Their bulletin implies it at least, I seem to remember the same.

Enabled on Azure Ubuntu, FWIW:

  $ ethtool -k eth0 | grep tcp-seg
  tcp-segmentation-offload: on

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#44

Post by foofc7c8 »

syn0byte wrote: post #41
foofc7c8 wrote: post #35

Earlier quoted context omitted.

Can't find anywhere prerequisite on segment offloading, any link on this?

The link to the article.... "When Segmentation offload is on and SACK mechanism is also enabled, due to packet loss and selective retransmission of some packets, SKB could end up holding multiple packets, counted by ‘tcp_gso_segs’." Segmentation offload in linux is dependent on checksum offloads per here: https://www.kernel.org/doc/Documentation/networking/segmenta...

Thank you, syn0byte.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#45

Post by bndw »

gravitas wrote: post #18

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

CoreOS

   https://coreos.com/releases/#2079.6.0

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#46

Post by captn3m0 »

gravitas wrote: post #18

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

CoreOS has a new release out: https://coreos.com/releases/#2079.6.0

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#47

Post by jhayward »

gravitas wrote: post #18

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

If you don't use the block-quote format, HN will make the links clickable:

[edit: deleted link, OP has updated]

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#48

Post by sp332 »

sl-1 wrote: post #30

Is there any way to quickly test if any of my machines are vulnerable?

If you click the Diagnose tab, there's a script that will check your kernel versions and relevant TCP settings. https://access.redhat.com/sites/default/files/cve-2019-11477... If you're not running RedHat, the kernel detection might be too strict, but at least there's some example code for you to check your own settings.

Re: SACK Panic – Multiple TCP-based remote denial-of-service issues

#50

Post by gravitas »

bndw wrote: post #45
gravitas wrote: post #18

I'm collecting vendor links internally for work: Red Hat / CentOS https://access.redhat.com/security/vulnerabilities/tcpsack https://access.redhat.com/security/cve/cve-2019-11477 https://access.redhat.com/security/cve/cve-2019-11478 https://access.redhat.com/security/cve/cve-2019-11479 Ubuntu https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... h…

CoreOS https://coreos.com/releases/#2079.6.0

Added, thanks.
Post reply on HN