Exploit Cybersecurity study of the dark web exposes vulnerability to machine identities -- ScienceDaily

Published on June 18th, 2019 📆 | 5376 Views ⚑


Linux Kernel SACK TCP Packet Kernel Panic denial of service

CVSS Meta Temp Score Current Exploit Price (≈)
7.2 $0-$5k

A vulnerability was found in Linux Kernel (Operating System) (unknown version). It has been rated as critical. This issue affects an unknown part of the component SACK Handler. The manipulation as part of a TCP Packet leads to a denial of service vulnerability (Kernel Panic). Using CWE to declare the problem leads to CWE-404. Impacted is availability.

The weakness was released 06/17/2019 with Netflix as Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues as confirmed posting (oss-sec). The advisory is shared at openwall.com. The identification of this vulnerability is CVE-2019-11477. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/18/2019).

Applying the patch PATCH_net_1_4.patch is able to eliminate this problem. It is possible to mitigate the problem by applying the configuration setting /proc/sys/net/ipv4/tcp_sack = 0. The best possible mitigation is suggested to be patching the affected component. A possible mitigation has been published immediately after the disclosure of the vulnerability.

github.com is providing further details.




VulDB Meta Base Score: 7.5
VulDB Meta Temp Score: 7.2

VulDB Base Score: 7.5
VulDB Temp Score: 7.2
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Denial of service / Kernel Panic (CWE-404)
Local: No
Remote: Yes

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Patch
Status: 🔍

Reaction Time: 🔒
0-Day Time: 🔒
Exposure Time: 🔒

Patch: PATCH_net_1_4.patch
Config: /proc/sys/net/ipv4/tcp_sack = 0

06/17/2019 Advisory disclosed
06/17/2019 +0 days Countermeasure disclosed
06/18/2019 +1 days VulDB entry created
06/18/2019 +0 days VulDB last updateVendor: kernel.org

Advisory: Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service issues
Organization: Netflix
Status: Confirmed

CVE: CVE-2019-11477 (🔒)
Misc.: 🔒

Created: 06/18/2019 10:44 AM
Complete: 🔍


No comments yet. Please log in to comment.

Use the official API to access entries easily!


Download WordPress Themes Free
Premium WordPress Themes Download
Download WordPress Themes Free
Download WordPress Themes Free
free download udemy course

Tagged with:

Leave a Reply ✍