SACK Panic – Multiple TCP-based remote denial-of-service issues

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by hoffie on Monday June 17, 2019 @02:14PM (#20205834)

Red Hat's article on these issues also provides further explanations: https://access.redhat.com/security/vulnerabilities/tcpsack

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by dang on Monday June 17, 2019 @02:30PM (#20205983)

That seems to have a bit more information, so we switched to it from https://www.openwall.com/lists/oss-security/2019/06/17/5. Thanks!

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by loeg on Monday June 17, 2019 @04:52PM (#20207249)

https://github.com/Netflix/security-bulletins/blob/master/ad... is the advisory by the party that discovered the issue. (Disclosure: I have met Jonathan Looney and know some of the Netflix engineering staff, but I don't work for Netflix.)

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by caf on Monday June 17, 2019 @09:12PM (#20208967)

This mentions FreeBSD impacts as well which the RedHat link doesn't.

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by trasz on Tuesday June 18, 2019 @07:47AM (#20211955)

For FreeBSD only the RACK stack seems to be affected - that's an alternative TCP/IP stack, not the default one.

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by ilkkao on Monday June 17, 2019 @03:13PM (#20206352)

The original link includes links to the patches. Fascinating how the SACK MSS problem seems to be a relatively simple situation nobody realized can occur.

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by jandrese on Monday June 17, 2019 @04:15PM (#20206859)

You'd have to dig pretty deep to realize that the kernel structure is limited to just 17 entries, and then do the math with minimum packet sizes vs. header sizes.

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by bauruine on Monday June 17, 2019 @03:38PM (#20206555)

There is also an ansible playbook on the resolve tab to easily apply the net.ipv4.tpc_sack workaround on all your hosts.

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by pferde on Monday June 17, 2019 @05:39PM (#20207652)

With a typo ("tpc_sack" instead of "tcp_sack") in the task name. The playbook still works, but I found it chuckle-worthy. :)

[ Parent | on HN ]

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by wademealing on Tuesday June 18, 2019 @02:56AM (#20210315)

Thanks for the report, getting our team to fix that.

[ Parent | on HN ]