F5 Networks BIG-IP : Linux SACK Panic vulnerability (K78234183) (SACK Panic)

high Nessus Plugin ID 129316
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 6.7

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
(CVE-2019-11477)

Impact

BIG-IP

The BIG-IP system has no exposure to this vulnerability within the Traffic Management Microkernel (TMM), including virtual servers and virtual IP addresses (also known as the data plane). However, the BIG-IP system is vulnerable via the self IP addresses and the management interface (also known as the control plane). A remote attacker can exploit this vulnerability to cause a denial of service (DoS) by sending a sequence of specially crafted TCP packets.

Backend systems accessed via a FastL4 virtual server

By its nature as a full-proxy, the BIG-IP system protects backend systems accessed through a standard virtual server, as any attacker's TCP connection would be terminated at the BIG-IP system. However, backend systems accessed via a FastL4 virtual server(a virtual server configured with a FastL4 profile) are exposed by default as the attack traffic is forwarded as-is to the backend system.

Traffix SDC

A remote attacker can exploit this vulnerability to cause a denial of service by sending a sequence of specially crafted TCP SACK packets.

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K78234183.

See Also

https://support.f5.com/csp/article/K78234183

Plugin Details

Severity: High

ID: 129316

File Name: f5_bigip_SOL78234183.nasl

Version: 1.5

Type: local

Published: 9/25/2019

Updated: 2/12/2020

Dependencies: f5_bigip_detect.nbin

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS v2.0

Base Score: 7.8

Temporal Score: 5.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 6/19/2019

Vulnerability Publication Date: 6/19/2019

Reference Information

CVE: CVE-2019-11477