147 lines
5.6 KiB
Text
147 lines
5.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-19:08.rack Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Resource exhaustion in non-default RACK TCP stack
|
|
|
|
Category: core
|
|
Module: inet
|
|
Announced: 2019-06-19
|
|
Credits: Jonathan Looney (Netflix)
|
|
Peter Lei (Netflix)
|
|
Affects: FreeBSD 12.0 and later
|
|
Corrected: 2019-06-19 16:25:39 UTC (stable/12, 12.0-STABLE)
|
|
2019-06-19 16:43:05 UTC (releng/12.0, 12.0-RELEASE-p6)
|
|
CVE Name: CVE-2019-5599
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The Transmission Control Protocol (TCP) of the TCP/IP protocol suite provides
|
|
a connection-oriented, reliable, sequence-preserving data stream service.
|
|
|
|
A TCP loss detection algorithm called RACK ("Recent ACKnowledgment") uses the
|
|
notion of time, in addition to packet or sequence counts, to detect losses
|
|
for modern TCP implementations that support per-packet timestamps and the
|
|
selective acknowledgment (SACK) option.
|
|
|
|
FreeBSD ships an optional implementation of RACK. Please note this is not
|
|
included by default. If RACK was not specifically compiled, installed, and
|
|
loaded, the system is not vulnerable.
|
|
|
|
II. Problem Description
|
|
|
|
While processing acknowledgements, the RACK code uses several linked lists to
|
|
maintain state entries. A malicious attacker can cause the lists to grow
|
|
unbounded. This can cause an expensive list traversal on every packet being
|
|
processed, leading to resource exhaustion and a denial of service.
|
|
|
|
III. Impact
|
|
|
|
An attacker with the ability to send specially crafted TCP traffic to a
|
|
victim system can degrade network performance and/or consume excessive CPU by
|
|
exploiting the inefficiency of traversing the potentially very large RACK
|
|
linked lists with relatively small bandwidth cost.
|
|
|
|
IV. Workaround
|
|
|
|
By default RACK is not compiled or loaded into the TCP stack. To determine
|
|
if you are using RACK, check the net.inet.tcp.functions_available sysctl.
|
|
If it includes a line with "rack", the RACK stack is loaded.
|
|
|
|
To disable RACK, unload the kernel module with:
|
|
|
|
# kldunload tcp_rack
|
|
|
|
Note: it may be required to use the force flag (-f) with the kldunload.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or release /
|
|
security branch (releng) dated after the correction date.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
Since the tcp_rack kernel module is not built by default, recompile,
|
|
reinstall, and reload the kernel module.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-19:08/rack.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-19:08/rack.patch.asc
|
|
# gpg --verify rack.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile, reinstall, and reload the tcp_rack kernel module.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/12/ r349197
|
|
releng/12.0/ r349199
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5599>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-19:08.rack.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl0KZy1fFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cK8ZxAAjT8bPjh+U0DGQEjnWvmzkMl7sDd2ISMTzKXh+WVGZ0wdwLuHqCHbBhHw
|
|
POAyJ4VprY9bGFK1EkoDuA5x0MPRXV4Zbk9I9eNKmzjbvj1JW92fubr/t6ITqiNp
|
|
2BAGK6iZ61saZyZNmQvTcZZzEao1ZRqylI3OEJWUwt9nomW6RJhRbRoJvbhl9oJE
|
|
Dz+ZjtZmf5oKccfkgoom8i7s4sHM1wFu+S00gYM7X/Nznv2S3B66pBYVhID30MGE
|
|
TKUqDYKdX7UbO/+WsWYVVBOA8Sp7FbdWLMGXXmk7jA9cVW+YUpir7yMYzIU5Ps6R
|
|
rLMQv4Rc593aznEDdvZkElW6AGMfLh4dpzqBKHbidKSZTv7q0KNQ52XJb18wD8n3
|
|
1vr4L54HKai1xfl52MvLvUP7hPjLR1jW1W6QJ5Hk3qGU4aViifStY5VfJ/8J6uuT
|
|
FUi5J9szYDraT8mWlIRfZNTRnbrQX2FoLjjsouL8v9kCj+83NB92wh+vylplVzKF
|
|
vlw18g6yC6USuE90OfdY9gXFRxiUWE+/Y0R0+/aEvuqSa9mMLQfolznl3zf1RaK8
|
|
GWX892iYmYYiTjN/HKttkdvfrQMYWLoW4COO+6h09VyNApQSpLikclERLnysi72M
|
|
EHRUquiZdZyV7nFmQGAeW779sdSE0d6gUTvS6Ak/PTzfAhy/Vj8=
|
|
=ggzB
|
|
-----END PGP SIGNATURE-----
|