CVE-2019-11479

kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service

Published Jun 18, 2019 CVSS 3.1 · 7.5 High EPSS 91.3% KEV · Not listed
Description
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1823-1 linux security update
Debian DLA Debian DLA DLA-1824-1 linux-4.9 security update
Debian DSA Debian DSA DSA-4465-1 linux security update
Ubuntu USN Ubuntu USN USN-4041-1 Linux kernel update
Ubuntu USN Ubuntu USN USN-4041-2 Linux kernel (HWE) update
References
Link Providers
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2019/06/28/2 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2019/07/06/3 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2019/07/06/4 cve-icon cve-icon
http://www.securityfocus.com/bid/108818 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1594 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1602 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1699 cve-icon cve-icon
https://access.redhat.com/security/vulnerabilities/tcpsack cve-icon cve-icon
https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf cve-icon cve-icon
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5f3e2bf008c2221478101ee72f5cb4654b9fc363 cve-icon cve-icon
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=967c05aee439e6e5d7d805e195b3a20ef5c433d6 cve-icon cve-icon
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md cve-icon cve-icon
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193 cve-icon cve-icon
https://kc.mcafee.com/corporate/index?page=content&id=SB10287 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-11479 cve-icon
https://patchwork.ozlabs.org/project/netdev/list/?series=114310 cve-icon
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0008 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20190625-0001/ cve-icon cve-icon
https://support.f5.com/csp/article/K35421172 cve-icon cve-icon
https://support.f5.com/csp/article/K35421172?utm_source=f5support&amp%3Butm_medium=RSS cve-icon cve-icon
https://usn.ubuntu.com/4041-1/ cve-icon cve-icon
https://usn.ubuntu.com/4041-2/ cve-icon cve-icon
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-11479 cve-icon
https://www.kb.cert.org/vuls/id/905115 cve-icon cve-icon
https://www.openwall.com/lists/oss-security/2019/06/17/5 cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.synology.com/security/advisory/Synology_SA_19_28 cve-icon cve-icon
https://www.us-cert.gov/ics/advisories/icsa-19-253-03 cve-icon cve-icon
https://www.us-cert.gov/ics/advisories/icsma-20-170-06 cve-icon cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
canonical
Published
Updated
Sep 16, 2024, 11:22 PM
Reserved
Apr 23, 2019, 12:00 AM
Status
Modified
Published
Jun 19, 2019, 12:15 AM
Modified
Jun 17, 2026, 2:12 AM
Severity
Moderate
Public date
Jun 17, 2019, 5:00 PM