CVE-2019-11477: Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

Modified

AliasesUBUNTU-CVE-2019-11477DEBIAN-CVE-2019-11477

Published 18-06-2019Last modified 17-09-2024

Vulnerability summary

CVE-2019-11477 is a high (CVSS 7.8) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 98.75% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 99% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

98.75%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 52 · Related 31

DLA-1823-1 DLA-1824-1 DSA-4465-1 MGASA-2019-0195 MGASA-2019-0196 MGASA-2019-0197+46 more

Timeline

18-06-2019
PublishedVulnerability first disclosed.
17-09-2024
Last modifiedVulnerability information updated.

Description

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.

CVSS metrics

7 scores · 4 sources · 3 versions

v3.17.5v3.07.5v2.07.8

EPSS trend

Probability

98.75%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 98.75% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu22 products

linux< 3.13.0-173.224 | < 4.4.0-151.178 | < 4.15.0-52.56
linux-aws< 4.4.0-1054.58 | < 4.4.0-1085.96 | < 4.15.0-1041.43
linux-aws-hwe< 4.15.0-1041.43~16.04.1
linux-azure< 4.15.0-1059.64~14.04.1 | < 4.15.0-1047.51 | < 4.18.0-1020.20~18.04.1
linux-azure-fdeAll versions (No fix recorded)

Show all 22

F514 products

big-ip_access_policy_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
big-ip_advanced_firewall_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
big-ip_analytics≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
big-ip_application_acceleration_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
big-ip_application_security_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0

Show all 14

Redhat5 products

enterprise_linuxEOL5.0 | 6.0 | 7.0 | 8.0
enterprise_linux_atomic_hostna
enterprise_linux_aus6.5 | 6.6
enterprise_linux_eus7.4 | 7.5
enterprise_mrg2.0

Pulsesecure2 products

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10 | 19.04

Debian1 product

linux< 4.19.37-4

Ivanti1 product

connect securena

Linux1 product

linux_kernel≥ 4.4, < 4.4.182 | ≥ 4.9, < 4.9.182 | ≥ 4.14, < 4.14.127 | ≥ 4.19, < 4.19.52 | ≥ 5.1, < 5.1.11 | ≥ 2.6.29, < 3.16.69 | ≥ 3.17, < 4.4.182 | ≥ 4.5, < 4.9.182 | ≥ 4.10, < 4.14.127 | ≥ 4.15, < 4.19.52 | ≥ 4.20, < 5.1.11

8 vendors · 47 products

References

34 links

www.kb.cert.org/vuls/id/905115Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.openwall.com/lists/oss-security/2019/06/20/3Mailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHSA-2019:1594Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2019:1602Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.openwall.com/lists/oss-security/2019/06/28/2Mailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2019/07/06/3Mailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2019/07/06/4Mailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHSA-2019:1699Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.openwall.com/lists/oss-security/2019/10/24/1Mailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2019/10/29/3Mailing ListX Refsource MLISTThird Party Advisory

Show all 34 references

www.oracle.com/security-alerts/cpujan2020.htmlX Refsource MISCThird Party Advisory
www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISCThird Party Advisory
git.kernel.org/pub/…X Refsource MISCMailing ListPatchVendor Advisory
github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdX Refsource MISCPatchThird Party Advisory
wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanicX Refsource MISCMitigationThird Party AdvisoryREPORT
access.redhat.com/security/vulnerabilities/tcpsackX Refsource MISCThird Party Advisory
support.f5.com/csp/article/K78234183X Refsource CONFIRMThird Party Advisory
packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193X Refsource CONFIRMThird Party Advisory
www.synology.com/security/advisory/Synology_SA_19_28X Refsource CONFIRMThird Party Advisory
security.netapp.com/advisory/ntap-20190625-0001/X Refsource CONFIRMThird Party Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0006X Refsource CONFIRMThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10287X Refsource CONFIRMThird Party Advisory
www.vmware.com/security/advisories/VMSA-2019-0010.htmlX Refsource CONFIRMThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-462066.pdfX Refsource CONFIRMThird Party Advisory
www.us-cert.gov/ics/advisories/icsa-19-253-03X Refsource MISCThird Party AdvisoryUS Government Resource
packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry
www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-kernel-enX Refsource CONFIRMThird Party Advisory
www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txtX Refsource CONFIRMThird Party Advisory
ubuntu.com/security/CVE-2019-11477REPORT
ubuntu.com/security/notices/USN-4017-1Advisory
ubuntu.com/security/notices/USN-4017-2Advisory
www.cve.org/CVERecord?id=CVE-2019-11477REPORT
security-tracker.debian.org/tracker/CVE-2019-11477Advisory