News for hackers. Stuff that matters.

A comment on SACK Panic – Multiple TCP-based remote denial-of-service issues. Parent comment

Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by dang on Monday June 17, 2019 @02:30PM (#20205983)
That seems to have a bit more information, so we switched to it from https://www.openwall.com/lists/oss-security/2019/06/17/5. Thanks!
[ Parent | on HN ]
Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by loeg on Monday June 17, 2019 @04:52PM (#20207249)
https://github.com/Netflix/security-bulletins/blob/master/ad... is the advisory by the party that discovered the issue. (Disclosure: I have met Jonathan Looney and know some of the Netflix engineering staff, but I don't work for Netflix.)
[ Parent | on HN ]
Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by caf on Monday June 17, 2019 @09:12PM (#20208967)
This mentions FreeBSD impacts as well which the RedHat link doesn't.
[ Parent | on HN ]
Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by trasz on Tuesday June 18, 2019 @07:47AM (#20211955)
For FreeBSD only the RACK stack seems to be affected - that's an alternative TCP/IP stack, not the default one.
[ Parent | on HN ]
Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by ilkkao on Monday June 17, 2019 @03:13PM (#20206352)
The original link includes links to the patches. Fascinating how the SACK MSS problem seems to be a relatively simple situation nobody realized can occur.
[ Parent | on HN ]
Re:SACK Panic – Multiple TCP-based remote denial-of-service ... by jandrese on Monday June 17, 2019 @04:15PM (#20206859)
You'd have to dig pretty deep to realize that the kernel structure is limited to just 17 entries, and then do the math with minimum packet sizes vs. header sizes.
[ Parent | on HN ]