CVE-2019-11478

MEDIUM

Published 2019-06-18T23:34:51.077803Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-11478. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.0

5.3

/10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2023.03.01

0.956

probability

of exploitation in the wild

There is a 95.6% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-01-25

Exploit Probability

Percentile: 0.996

Higher than 99.6% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Description

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Linux

Linux kernel

Affected Versions:

4.4 4.9 4.14 4.19 5.1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-xh2h-cw6h-x9h5

Advisory Details

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-11478

WEB https://www.us-cert.gov/ics/advisories/icsa-19-253-03

WEB https://www.synology.com/security/advisory/Synology_SA_19_28

WEB https://www.oracle.com/security-alerts/cpuoct2020.html

WEB https://www.oracle.com/security-alerts/cpujan2020.html

WEB https://www.kb.cert.org/vuls/id/905115

WEB https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic

WEB https://support.f5.com/csp/article/K26618426

WEB https://security.netapp.com/advisory/ntap-20190625-0001

WEB https://seclists.org/bugtraq/2019/Jul/30

WEB https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007

WEB https://kc.mcafee.com/corporate/index?page=content&id=SB10287

WEB https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193

WEB https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

WEB https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e

WEB https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf

WEB https://access.redhat.com/security/vulnerabilities/tcpsack

WEB https://access.redhat.com/errata/RHSA-2019:1699

WEB https://access.redhat.com/errata/RHSA-2019:1602

WEB https://access.redhat.com/errata/RHSA-2019:1594

WEB http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html

WEB http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html

WEB http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

WEB http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt

WEB http://www.openwall.com/lists/oss-security/2019/06/28/2

WEB http://www.openwall.com/lists/oss-security/2019/07/06/3

WEB http://www.openwall.com/lists/oss-security/2019/07/06/4

WEB http://www.openwall.com/lists/oss-security/2019/10/24/1

WEB http://www.openwall.com/lists/oss-security/2019/10/29/3

WEB http://www.vmware.com/security/advisories/VMSA-2019-0010.html

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: February 27, 2024

References

https://www.kb.cert.org/vuls/id/905115

https://access.redhat.com/errata/RHSA-2019:1594

https://access.redhat.com/errata/RHSA-2019:1602

http://www.openwall.com/lists/oss-security/2019/06/28/2

http://www.openwall.com/lists/oss-security/2019/07/06/3

http://www.openwall.com/lists/oss-security/2019/07/06/4

https://access.redhat.com/errata/RHSA-2019:1699

https://seclists.org/bugtraq/2019/Jul/30

http://www.openwall.com/lists/oss-security/2019/10/24/1

http://www.openwall.com/lists/oss-security/2019/10/29/3

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic

https://access.redhat.com/security/vulnerabilities/tcpsack

http://packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.html

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193

https://www.synology.com/security/advisory/Synology_SA_19_28

https://security.netapp.com/advisory/ntap-20190625-0001/

https://kc.mcafee.com/corporate/index?page=content&id=SB10287

http://www.vmware.com/security/advisories/VMSA-2019-0010.html

https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf

https://www.us-cert.gov/ics/advisories/icsa-19-253-03

http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txt

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=f070ef2ac66716357066b683fb0baf55f8191a2e

https://support.f5.com/csp/article/K26618426

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007

http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html

Published: 2019-06-18T23:34:51.077803Z

Last Modified: 2024-09-16T23:45:54.779Z

Copied to clipboard!

CVE-2019-11478

Expert Analysis

CVSS Score

EPSS Score

Attack Vector Metrics

Impact Metrics

Description

Available Exploits

Related News

Affected Products

Linux kernel

Affected Versions:

GitHub Security Advisories

Advisory Details

CVSS Scoring

CVSS Score

CVSS Vector

References

References

Request Analysis

What to expect

Request Received!