CVE-2019-11478: SACK can cause extensive memory use via fragmented resend queue
Modified
AliasesSUSE-SU-2019:1888-1SUSE-SU-2019:1935-1UBUNTU-CVE-2019-11478DEBIAN-CVE-2019-11478
Published 18-06-2019Last modified 16-09-2024
Vulnerability summary
CVE-2019-11478 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 94.69% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
94.69%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 52 · Related 31DLA-1823-1DLA-1824-1DSA-4465-1MGASA-2019-0195MGASA-2019-0196MGASA-2019-0197OPENSUSE-SU-2019:1571-1OPENSUSE-SU-2019:1579-1OPENSUSE-SU-2024:10728-1OPENSUSE-SU-2024:13704-1RHSA-2019:1479RHSA-2019:1480RHSA-2019:1481RHSA-2019:1482RHSA-2019:1483RHSA-2019:1484RHSA-2019:1485RHSA-2019:1486RHSA-2019:1487RHSA-2019:1488RHSA-2019:1489RHSA-2019:1490RHSA-2019:1594RHSA-2019:1602RHSA-2019:1699SUSE-SU-2019:14089-1SUSE-SU-2019:1527-1SUSE-SU-2019:1529-1SUSE-SU-2019:1530-1SUSE-SU-2019:1532-1SUSE-SU-2019:1533-1SUSE-SU-2019:1534-1SUSE-SU-2019:1535-1SUSE-SU-2019:1550-1SUSE-SU-2019:1581-1SUSE-SU-2019:1588-1SUSE-SU-2019:1668-1SUSE-SU-2019:1671-1SUSE-SU-2019:1674-1SUSE-SU-2019:1692-1SUSE-SU-2019:1851-1SUSE-SU-2019:1855-1SUSE-SU-2019:1882-1SUSE-SU-2019:1889-1SUSE-SU-2019:1924-1SUSE-SU-2019:1948-1SUSE-SU-2019:2069-1SUSE-SU-2019:2430-1SUSE-SU-2019:2450-1SUSE-SU-2019:2821-1USN-4017-1USN-4017-2
Timeline
- 18-06-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources4 sources · 5.3–7.5
- CVE.orgCNA5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
94.69%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 94.69% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu22 products
- linux< 3.13.0-173.224 | < 4.4.0-151.178 | < 4.15.0-52.56
- linux-aws< 4.4.0-1054.58 | < 4.4.0-1085.96 | < 4.15.0-1041.43
- linux-aws-hwe< 4.15.0-1041.43~16.04.1
- linux-azure< 4.15.0-1059.64~14.04.1 | < 4.15.0-1047.51 | < 4.18.0-1020.20~18.04.1
- linux-azure-fdeAll versions (No fix recorded)
F514 products
- big-ip_access_policy_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
- big-ip_advanced_firewall_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
- big-ip_analytics≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
- big-ip_application_acceleration_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
- big-ip_application_security_manager≥ 11.5.2, ≤ 11.6.4 | ≥ 12.1.0, ≤ 12.1.4 | ≥ 13.1.0, ≤ 13.1.1 | ≥ 14.0.0, ≤ 14.1.0 | 15.0.0
Suse10 products
- kernel-livepatch-SLE15_Update_11&distro=SUSE Linux Enterprise Live Patching 15< 2-2.1
- kernel-livepatch-SLE15-SP1_Update_1&distro=SUSE Linux Enterprise Live Patching 15 SP1< 3-2.1
- kernel-livepatch-SLE15-SP1_Update_2&distro=SUSE Linux Enterprise Live Patching 15 SP1< 2-2.1
- kgraft-patch-SLE12-SP1_Update_34&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 3-2.1
- kgraft-patch-SLE12-SP1_Update_34&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 3-2.1
Redhat5 products
- enterprise_linuxEOL5.0 | 6.0 | 7.0 | 8.0
- enterprise_linux_atomic_hostna
- enterprise_linux_aus6.5 | 6.6
- enterprise_linux_eus7.4 | 7.5
- enterprise_mrg2.0
Pulsesecure2 products
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10 | 19.04
Debian1 product
- linux< 4.19.37-4
Ivanti1 product
Linux1 product
- linux_kernel≥ 4.4, < 4.4.182 | ≥ 4.9, < 4.9.182 | ≥ 4.14, < 4.14.127 | ≥ 4.19, < 4.19.52 | ≥ 5.1, < 5.1.11 | < 4.4.182 | ≥ 4.5, < 4.9.182 | ≥ 4.10, < 4.14.127 | ≥ 4.15, < 4.19.52 | ≥ 4.20, < 5.1.11
9 vendors · 57 products
References
38 linksShow all 38 references
- www.oracle.com/security-alerts/cpujan2020.htmlX Refsource MISC
- www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISC
- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.mdX Refsource MISCPatchThird Party Advisory
- wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanicX Refsource MISCMitigationThird Party AdvisoryREPORT
- packetstormsecurity.com/files/153346/Kernel-Live-Patch-Security-Notice-LSN-0052-1.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44193X Refsource CONFIRMThird Party Advisory
- www.synology.com/security/advisory/Synology_SA_19_28X Refsource CONFIRM
- security.netapp.com/advisory/ntap-20190625-0001/X Refsource CONFIRM
- kc.mcafee.com/corporate/index?page=content&id=SB10287X Refsource CONFIRM
- www.vmware.com/security/advisories/VMSA-2019-0010.htmlX Refsource CONFIRM
- cert-portal.siemens.com/productcert/pdf/ssa-462066.pdfX Refsource CONFIRM
- www.us-cert.gov/ics/advisories/icsa-19-253-03X Refsource MISC
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-010.txtX Refsource CONFIRM
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0007X Refsource CONFIRM
