Skip to content
OpenAdvisories
High ELSA-2019-1481 3 CVEs

Important: kernel security update (Oracle Linux 7)

Published Jun 18, 2019 · Updated Jun 18, 2019

Ecosystem: Oracle Linux

Summary

[3.10.0-957.21.3.OL7]
- Oracle Linux certificates (Alexey Petrenko)
- Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
- Update x509.genkey [bug 24817676]

[3.10.0-957.21.3]
- [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
- [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
- [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
- [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
- [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 7 bpftool 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-abi-whitelists 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-debug 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-debug-devel 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-devel 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-doc 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-headers 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-tools 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-tools-libs 0:3.10.0-957.21.3.el7
Oracle Linux · 7 kernel-tools-libs-devel 0:3.10.0-957.21.3.el7
Oracle Linux · 7 perf 0:3.10.0-957.21.3.el7
Oracle Linux · 7 python-perf 0:3.10.0-957.21.3.el7

Vulnerabilities 3

  • High 7.5
    CVE-2019-11477 Public exploit EPSS 99%

    Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

    Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2019-11478 Public exploit EPSS 94%

    SACK can cause extensive memory use via fragmented resend queue

    Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of serv…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2019-11479 EPSS 91%

    Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fr…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu