Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2019-11478

SACK can cause extensive memory use via fragmented resend queue

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux kernel

  • 4.4 to < 4.4.182affected
  • 4.9 to < 4.9.182affected
  • 4.14 to < 4.14.127affected
  • 4.19 to < 4.19.52affected
  • 5.1 to < 5.1.11affected

References