Описание
Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-8460
- https://github.com/openbsd/src/commit/ed8fdce754a5d8d14c09e989d8877707bd43906f
- https://ftp.openbsd.org/pub/OpenBSD/patches/6.5/common/006_tcpsack.patch.sig
- https://research.checkpoint.com/tcp-sack-security-issue-in-openbsd-cve-2019-8460
- https://security.netapp.com/advisory/ntap-20190905-0001
- https://us-cert.cisa.gov/ics/advisories/icsa-19-253-03
Связанные уязвимости
OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Уязвимость функции tcp_sack_option () ядра операционной системы OpenBSD, позволяющая нарушителю вызвать отказ в обслуживании