You are here

TCP SACK Panic

IDs: 
CVE-2019-11477, CVE-2019-11478, CVE-2019-5599, CVE-2019-11479
Keywords: 
Linux, SACK, TCP, MSS
Description: 

An integer overflow issue was found in the way the Linux kernel processes TCP Selective Acknowledgement (SACK) segments. A remote attacker could use this flaw to crash the Linux kernel by sending a specifically crafted sequence of SACK segments on a TCP connection with minimum value of TCP MSS, resulting in DoS [1].

Until now, there is no public information available on how easy the exploitation of this vulnerability is and whether Airlock WAF behind other network devices such as firewalls or loadbalancers is protected.

Back-end systems behind Airlock WAF are protected from external attacks.

Further, there are other less critical TCP-based DoS vulnerabilities found. For details see [2].

Resolution: 

Hotfixes for all supported Airlock WAF versions (7.2, 7.1.1 and 7.0.1) are available (HF0025). The criticality of the hotfix is high and we recommend to apply it to all Airlock WAF installations.

Component: 
Airlock
Airlock Vulnerability Status: 
Airlock vulnerable, see resolution
Back-end Vulnerability Status: 
Does not affect back-end behind Airlock