CVE-2019-11479
HIGHCVSS 7.5/10EPSS 91.66%
Last modified
CVE-2019-11479 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. EPSS estimates a 91.66% chance of exploitation in the next 30 days.
Description
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.4, < 4.4.182 |
| Linux | Linux Kernel | >= 4.9, < 4.9.182 |
| Linux | Linux Kernel | >= 4.14, < 4.14.127 |
| Linux | Linux Kernel | >= 4.19, < 4.19.52 |
| Linux | Linux Kernel | >= 5.1, < 5.1.11 |
| F5 | Big-Ip Advanced Firewall Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Advanced Firewall Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Advanced Firewall Manager | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Advanced Firewall Manager | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Advanced Firewall Manager | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Advanced Firewall Manager | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Access Policy Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Access Policy Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Access Policy Manager | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Access Policy Manager | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Access Policy Manager | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Access Policy Manager | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Application Acceleration Manager | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Link Controller | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Link Controller | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Link Controller | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Link Controller | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Link Controller | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Link Controller | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Policy Enforcement Manager | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Webaccelerator | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Webaccelerator | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Webaccelerator | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Webaccelerator | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Webaccelerator | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Webaccelerator | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Application Security Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Application Security Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Application Security Manager | >= 13.1.0, < 13.1.3.2 |
| F5 | Big-Ip Application Security Manager | >= 14.0.0, < 14.0.1.1 |
| F5 | Big-Ip Application Security Manager | >= 14.1.2, < 14.1.2.1 |
| F5 | Big-Ip Application Security Manager | >= 15.0.0, < 15.0.1.1 |
| F5 | Big-Ip Local Traffic Manager | >= 11.5.2, < 11.6.5.1 |
| F5 | Big-Ip Local Traffic Manager | >= 12.1.0, < 12.1.5.1 |
| F5 | Big-Ip Local Traffic Manager | >= 13.1.0, < 13.1.3.2 |
Showing 50 of 95 affected configurations. See NVD for the full list.
References
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txtThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/06/28/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/07/06/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/07/06/4Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108818Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1594Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1602Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1699Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/tcpsackThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdfThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5f3e2bf008c2221478101ee72f5cb4654b9fc363Mailing List, Patch, Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=967c05aee439e6e5d7d805e195b3a20ef5c433d6Mailing List, Patch, Vendor Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdPatch, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10287Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0008Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190625-0001/Third Party Advisory
- https://support.f5.com/csp/article/K35421172Third Party Advisory
- https://usn.ubuntu.com/4041-1/Third Party Advisory
- https://usn.ubuntu.com/4041-2/Third Party Advisory
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanicMitigation, Third Party Advisory
- https://www.kb.cert.org/vuls/id/905115Third Party Advisory, US Government Resource
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_28Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-253-03Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-20-170-06Third Party Advisory, US Government Resource
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txtThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/06/28/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/07/06/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/07/06/4Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108818Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1594Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1602Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1699Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/tcpsackThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdfThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5f3e2bf008c2221478101ee72f5cb4654b9fc363Mailing List, Patch, Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=967c05aee439e6e5d7d805e195b3a20ef5c433d6Mailing List, Patch, Vendor Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdPatch, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10287Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0008Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190625-0001/Third Party Advisory
- https://support.f5.com/csp/article/K35421172Third Party Advisory
- https://usn.ubuntu.com/4041-1/Third Party Advisory
- https://usn.ubuntu.com/4041-2/Third Party Advisory
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanicMitigation, Third Party Advisory
- https://www.kb.cert.org/vuls/id/905115Third Party Advisory, US Government Resource
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_28Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-253-03Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-20-170-06Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11479?
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.
How severe is CVE-2019-11479?
CVE-2019-11479 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 91.66% probability of exploitation in the next 30 days.
How do I fix CVE-2019-11479?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2019-11479?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST