CVE-2019-11479 : Exploit Details and Defense Strategies
Discover the impact of CVE-2019-11479, a vulnerability in the Linux kernel allowing remote attackers to cause denial of service. Learn about affected versions and mitigation steps.
Jonathan Looney discovered a vulnerability in the Linux kernel that could allow a remote attacker to cause a denial of service by exploiting the default Maximum Segment Size (MSS) configuration.
Understanding CVE-2019-11479
This CVE involves a vulnerability in the Linux kernel related to TCP resend queue fragmentation due to a hardcoded MSS value.
What is CVE-2019-11479?
CVE-2019-11479 is a vulnerability in the Linux kernel that allows a remote attacker to significantly fragment TCP resend queues by exploiting the default MSS value.
The Impact of CVE-2019-11479
The vulnerability could be exploited by a remote attacker to cause a denial of service by fragmenting TCP resend queues.
Technical Details of CVE-2019-11479
This section provides more in-depth technical details about the vulnerability.
Vulnerability Description
The Linux kernel's default MSS of 48 bytes allows for significant TCP resend queue fragmentation, which can be exploited by a remote attacker.
Affected Systems and Versions
- Linux kernel versions 4.4, 4.9, 4.14, 4.19, and 5.1 are affected.
Exploitation Mechanism
- Attack Complexity: Low
- Attack Vector: Network
- Availability Impact: Low
- Base Score: 5.3 (Medium)
- CWE-405: Asymmetric Resource Consumption (Amplification)
Mitigation and Prevention
Protecting systems from CVE-2019-11479 requires immediate action and long-term security practices.
Immediate Steps to Take
- Update affected systems to stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, or 5.1.11.
- Apply the fixes found in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
Long-Term Security Practices
- Regularly update the Linux kernel to the latest stable releases.
- Monitor and apply security patches promptly to mitigate future vulnerabilities.
- Implement network security measures to prevent remote attacks.
Patching and Updates
- Refer to vendor advisories such as RHSA-2019:1594, RHSA-2019:1602, USN-4041-1, and USN-4041-2 for patching guidance and updates.