CVE-2019-11478

Published: Jun 19, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.

Affected (90)

Products: Linux: Linux Kernel · F5: Big Ip Advanced Firewall Manager, Big Ip Access Policy Manager, Big Ip Application Acceleration Manager, Big Ip Link Controller, Big Ip Policy Enforcement Manager, Big Ip Webaccelerator, Big Ip Application Security Manager, Big Ip Local Traffic Manager, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Analytics, Big Ip Edge Gateway, Big Ip Domain Name System, Traffix Signaling Delivery Controller · Canonical: Ubuntu Linux · +3 more

Show all products

Linux

1 product

Linux Kernel

14 products

Big Ip Advanced Firewall Manager

Big Ip Access Policy Manager

Big Ip Application Acceleration Manager

Big Ip Link Controller

Big Ip Policy Enforcement Manager

Big Ip Webaccelerator

Big Ip Application Security Manager

Big Ip Local Traffic Manager

Big Ip Fraud Protection Service

Big Ip Global Traffic Manager

Big Ip Analytics

Big Ip Edge Gateway

Big Ip Domain Name System

Traffix Signaling Delivery Controller

1 product

5 products

Enterprise Linux Atomic Host

1 product

2 products

Pulse Secure Virtual Application Delivery Controller

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 4.4.182
Linux Linux Kernel	From 4.10 to 4.14.127
Linux Linux Kernel	From 4.15 to 4.19.52
Linux Linux Kernel	From 4.20 to 5.1.11
Linux Linux Kernel	From 4.5 to 4.9.182

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Advanced Firewall Manager	From 11.5.2 to 11.6.4
F5 Big Ip Advanced Firewall Manager	From 12.1.0 to 12.1.4
F5 Big Ip Advanced Firewall Manager	From 13.1.0 to 13.1.1
F5 Big Ip Advanced Firewall Manager	From 14.0.0 to 14.1.0
F5 Big Ip Advanced Firewall Manager	Version 15.0.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	From 11.5.2 to 11.6.4
F5 Big Ip Access Policy Manager	From 12.1.0 to 12.1.4
F5 Big Ip Access Policy Manager	From 13.1.0 to 13.1.1
F5 Big Ip Access Policy Manager	From 14.0.0 to 14.1.0
F5 Big Ip Access Policy Manager	Version 15.0.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Application Acceleration Manager	From 11.5.2 to 11.6.4
F5 Big Ip Application Acceleration Manager	From 12.1.0 to 12.1.4
F5 Big Ip Application Acceleration Manager	From 13.1.0 to 13.1.1
F5 Big Ip Application Acceleration Manager	From 14.0.0 to 14.1.0
F5 Big Ip Application Acceleration Manager	Version 15.0.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Link Controller	From 11.5.2 to 11.6.4
F5 Big Ip Link Controller	From 12.1.0 to 12.1.4
F5 Big Ip Link Controller	From 13.1.0 to 13.1.1
F5 Big Ip Link Controller	From 14.0.0 to 14.1.0
F5 Big Ip Link Controller	Version 15.0.0

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Policy Enforcement Manager	From 11.5.2 to 11.6.4
F5 Big Ip Policy Enforcement Manager	From 12.1.0 to 12.1.4
F5 Big Ip Policy Enforcement Manager	From 13.1.0 to 13.1.1
F5 Big Ip Policy Enforcement Manager	From 14.0.0 to 14.1.0
F5 Big Ip Policy Enforcement Manager	Version 15.0.0

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Webaccelerator	From 11.5.2 to 11.6.4
F5 Big Ip Webaccelerator	From 12.1.0 to 12.1.4
F5 Big Ip Webaccelerator	From 13.1.0 to 13.1.1
F5 Big Ip Webaccelerator	From 14.0.0 to 14.1.0
F5 Big Ip Webaccelerator	Version 15.0.0

Configuration H

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Application Security Manager	From 11.5.2 to 11.6.4
F5 Big Ip Application Security Manager	From 12.1.0 to 12.1.4
F5 Big Ip Application Security Manager	From 13.1.0 to 13.1.1
F5 Big Ip Application Security Manager	From 14.0.0 to 14.1.0
F5 Big Ip Application Security Manager	Version 15.0.0

Configuration I

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Local Traffic Manager	From 11.5.2 to 11.6.4
F5 Big Ip Local Traffic Manager	From 12.1.0 to 12.1.4
F5 Big Ip Local Traffic Manager	From 13.1.0 to 13.1.1
F5 Big Ip Local Traffic Manager	From 14.0.0 to 14.1.0
F5 Big Ip Local Traffic Manager	Version 15.0.0

Configuration J

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Fraud Protection Service	From 11.5.2 to 11.6.4
F5 Big Ip Fraud Protection Service	From 12.1.0 to 12.1.4
F5 Big Ip Fraud Protection Service	From 13.1.0 to 13.1.1
F5 Big Ip Fraud Protection Service	From 14.0.0 to 14.1.0
F5 Big Ip Fraud Protection Service	Version 15.0.0

Configuration K

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Global Traffic Manager	From 11.5.2 to 11.6.4
F5 Big Ip Global Traffic Manager	From 12.1.0 to 12.1.4
F5 Big Ip Global Traffic Manager	From 13.1.0 to 13.1.1
F5 Big Ip Global Traffic Manager	From 14.0.0 to 14.1.0
F5 Big Ip Global Traffic Manager	Version 15.0.0

Configuration L

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Analytics	From 11.5.2 to 11.6.4
F5 Big Ip Analytics	From 12.1.0 to 12.1.4
F5 Big Ip Analytics	From 13.1.0 to 13.1.1
F5 Big Ip Analytics	From 14.0.0 to 14.1.0
F5 Big Ip Analytics	Version 15.0.0

Configuration M

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Edge Gateway	From 11.5.2 to 11.6.4
F5 Big Ip Edge Gateway	From 12.1.0 to 12.1.4
F5 Big Ip Edge Gateway	From 13.1.0 to 13.1.1
F5 Big Ip Edge Gateway	From 14.0.0 to 14.1.0
F5 Big Ip Edge Gateway	Version 15.0.0

Configuration N

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Domain Name System	From 11.5.2 to 11.6.4
F5 Big Ip Domain Name System	From 12.1.0 to 12.1.4
F5 Big Ip Domain Name System	From 13.1.0 to 13.1.1
F5 Big Ip Domain Name System	From 14.0.0 to 14.1.0
F5 Big Ip Domain Name System	Version 15.0.0

Configuration O

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04

Configuration P

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Atomic Host	All versions
Redhat Enterprise Linux Aus	Version 6.5
Redhat Enterprise Linux Aus	Version 6.6
Redhat Enterprise Linux Eus	Version 7.4
Redhat Enterprise Linux Eus	Version 7.5
Redhat Enterprise Mrg	Version 2.0

Configuration Q

3 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	All versions
Pulsesecure Pulse Policy Secure	All versions
Pulsesecure Pulse Secure Virtual Application Delivery Controller	All versions

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
F5 Traffix Signaling Delivery Controller	From 5.0.0 to 5.1.0

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (58)

http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html

Source: security@ubuntu.com

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html

Source: security@ubuntu.com

http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

Source: security@ubuntu.com

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2019/06/28/2

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2019/07/06/3

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2019/07/06/4

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2019/10/24/1

Source: security@ubuntu.com

http://www.openwall.com/lists/oss-security/2019/10/29/3

Source: security@ubuntu.com

http://www.vmware.com/security/advisories/VMSA-2019-0010.html

Source: security@ubuntu.com

https://access.redhat.com/errata/RHSA-2019:1594

Source: security@ubuntu.com

https://access.redhat.com/errata/RHSA-2019:1602

Source: security@ubuntu.com

https://access.redhat.com/errata/RHSA-2019:1699

Source: security@ubuntu.com

https://access.redhat.com/security/vulnerabilities/tcpsack

Source: security@ubuntu.com

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf

Source: security@ubuntu.com

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e

Source: security@ubuntu.com

Mailing ListPatchVendor Advisory

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

Source: security@ubuntu.com

PatchThird Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193

Source: security@ubuntu.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10287

Source: security@ubuntu.com

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007

Source: security@ubuntu.com

https://seclists.org/bugtraq/2019/Jul/30

Source: security@ubuntu.com

https://security.netapp.com/advisory/ntap-20190625-0001/

Source: security@ubuntu.com

https://support.f5.com/csp/article/K26618426

Source: security@ubuntu.com

Third Party Advisory

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic

Source: security@ubuntu.com

MitigationThird Party Advisory

https://www.kb.cert.org/vuls/id/905115

Source: security@ubuntu.com

https://www.oracle.com/security-alerts/cpujan2020.html

Source: security@ubuntu.com

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security@ubuntu.com

https://www.synology.com/security/advisory/Synology_SA_19_28

Source: security@ubuntu.com

https://www.us-cert.gov/ics/advisories/icsa-19-253-03

Source: security@ubuntu.com

http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html